./Ultimate.py --spec ../../sv-benchmarks/c/properties/unreach-call.prp --file ../../sv-benchmarks/c/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c --full-output --architecture 32bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version aa418289 Calling Ultimate with: java -Dosgi.configuration.area=/tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data/config -Xmx12G -Xms1G -jar /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data -tc /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/config/AutomizerReach.xml -i ../../sv-benchmarks/c/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c -s /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 32bit --witnessprinter.graph.data.programhash 1420a5dac3676d838e2b742b3a84faa6df74a9e1 ............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................. Execution finished normally Using bit-precise analysis Retrying with bit-precise analysis Calling Ultimate with: java -Dosgi.configuration.area=/tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data/config -Xmx12G -Xms1G -jar /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data -tc /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/config/AutomizerReach.xml -i ../../sv-benchmarks/c/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c -s /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Bitvector.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 32bit --witnessprinter.graph.data.programhash 1420a5dac3676d838e2b742b3a84faa6df74a9e1 ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ Execution finished normally Writing output log to file Ultimate.log Writing human readable error path to file UltimateCounterExample.errorpath Result: FALSE --- Real Ultimate output --- This is Ultimate 0.1.23-aa41828 [2018-11-22 23:04:53,193 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-22 23:04:53,194 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-22 23:04:53,204 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-22 23:04:53,204 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-22 23:04:53,205 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-22 23:04:53,206 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-22 23:04:53,207 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-22 23:04:53,208 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-22 23:04:53,209 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-22 23:04:53,209 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-22 23:04:53,210 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-22 23:04:53,210 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-22 23:04:53,211 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-22 23:04:53,212 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-22 23:04:53,212 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-22 23:04:53,213 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-22 23:04:53,214 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-22 23:04:53,216 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-22 23:04:53,217 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-22 23:04:53,217 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-22 23:04:53,218 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-22 23:04:53,220 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-22 23:04:53,220 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-22 23:04:53,220 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-22 23:04:53,221 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-22 23:04:53,222 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-22 23:04:53,222 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-22 23:04:53,223 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-22 23:04:53,223 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-22 23:04:53,224 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-22 23:04:53,224 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-22 23:04:53,224 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-22 23:04:53,224 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-22 23:04:53,225 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-22 23:04:53,226 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-22 23:04:53,226 INFO L98 SettingsManager]: Beginning loading settings from /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Default.epf [2018-11-22 23:04:53,236 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-22 23:04:53,236 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-22 23:04:53,237 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-22 23:04:53,237 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-22 23:04:53,238 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-22 23:04:53,238 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-22 23:04:53,238 INFO L133 SettingsManager]: * Use SBE=true [2018-11-22 23:04:53,238 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-22 23:04:53,238 INFO L133 SettingsManager]: * sizeof long=4 [2018-11-22 23:04:53,239 INFO L133 SettingsManager]: * Overapproximate operations on floating types=true [2018-11-22 23:04:53,239 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-11-22 23:04:53,239 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-22 23:04:53,239 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-22 23:04:53,239 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-22 23:04:53,239 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-22 23:04:53,240 INFO L133 SettingsManager]: * sizeof long double=12 [2018-11-22 23:04:53,240 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-22 23:04:53,240 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-22 23:04:53,240 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-22 23:04:53,240 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-22 23:04:53,240 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-22 23:04:53,241 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-22 23:04:53,241 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-22 23:04:53,241 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-22 23:04:53,241 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-22 23:04:53,241 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-22 23:04:53,241 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-22 23:04:53,242 INFO L133 SettingsManager]: * Trace refinement strategy=CAMEL [2018-11-22 23:04:53,242 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-22 23:04:53,242 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2018-11-22 23:04:53,242 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 32bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> 1420a5dac3676d838e2b742b3a84faa6df74a9e1 [2018-11-22 23:04:53,263 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-22 23:04:53,272 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-22 23:04:53,275 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-22 23:04:53,276 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-22 23:04:53,276 INFO L276 PluginConnector]: CDTParser initialized [2018-11-22 23:04:53,277 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/../../sv-benchmarks/c/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c [2018-11-22 23:04:53,314 INFO L221 CDTParser]: Created temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data/50a81e5a9/cdfb10cb5cb040b5806dd6173dc47cb3/FLAG2c46e6f81 [2018-11-22 23:04:53,721 INFO L307 CDTParser]: Found 1 translation units. [2018-11-22 23:04:53,721 INFO L161 CDTParser]: Scanning /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/sv-benchmarks/c/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c [2018-11-22 23:04:53,733 INFO L355 CDTParser]: About to delete temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data/50a81e5a9/cdfb10cb5cb040b5806dd6173dc47cb3/FLAG2c46e6f81 [2018-11-22 23:04:54,082 INFO L363 CDTParser]: Successfully deleted /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data/50a81e5a9/cdfb10cb5cb040b5806dd6173dc47cb3 [2018-11-22 23:04:54,084 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-22 23:04:54,085 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-22 23:04:54,086 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-22 23:04:54,086 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-22 23:04:54,090 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-22 23:04:54,091 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,093 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@a313e41 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54, skipping insertion in model container [2018-11-22 23:04:54,093 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,100 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-22 23:04:54,149 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-22 23:04:54,417 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-22 23:04:54,425 INFO L191 MainTranslator]: Completed pre-run [2018-11-22 23:04:54,568 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-22 23:04:54,585 INFO L195 MainTranslator]: Completed translation [2018-11-22 23:04:54,585 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54 WrapperNode [2018-11-22 23:04:54,585 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-22 23:04:54,586 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-22 23:04:54,586 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-22 23:04:54,586 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-22 23:04:54,593 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,610 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,618 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-22 23:04:54,619 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-22 23:04:54,619 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-22 23:04:54,619 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-22 23:04:54,628 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,628 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,635 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,635 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,670 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,676 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,679 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... [2018-11-22 23:04:54,682 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-22 23:04:54,683 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-22 23:04:54,683 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-22 23:04:54,683 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-22 23:04:54,684 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (1/1) ... No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-22 23:04:54,735 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2018-11-22 23:04:54,735 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-22 23:04:54,735 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-22 23:04:54,735 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-11-22 23:04:54,735 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2018-11-22 23:04:54,735 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-11-22 23:04:54,735 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2018-11-22 23:04:54,735 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-11-22 23:04:54,736 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2018-11-22 23:04:54,736 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-22 23:04:54,736 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-22 23:04:54,736 INFO L130 BoogieDeclarations]: Found specification of procedure ssl3_connect [2018-11-22 23:04:54,736 INFO L138 BoogieDeclarations]: Found implementation of procedure ssl3_connect [2018-11-22 23:04:54,736 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-22 23:04:54,736 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-22 23:04:54,956 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-22 23:04:54,957 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-22 23:04:55,483 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-22 23:04:55,483 INFO L280 CfgBuilder]: Removed 1 assue(true) statements. [2018-11-22 23:04:55,483 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.11 11:04:55 BoogieIcfgContainer [2018-11-22 23:04:55,483 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-22 23:04:55,484 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-22 23:04:55,484 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-22 23:04:55,487 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-22 23:04:55,487 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 22.11 11:04:54" (1/3) ... [2018-11-22 23:04:55,488 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@664542a5 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 22.11 11:04:55, skipping insertion in model container [2018-11-22 23:04:55,488 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:04:54" (2/3) ... [2018-11-22 23:04:55,489 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@664542a5 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 22.11 11:04:55, skipping insertion in model container [2018-11-22 23:04:55,489 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.11 11:04:55" (3/3) ... [2018-11-22 23:04:55,490 INFO L112 eAbstractionObserver]: Analyzing ICFG s3_clnt.blast.03_false-unreach-call.i.cil.c [2018-11-22 23:04:55,500 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-22 23:04:55,507 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-22 23:04:55,523 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-22 23:04:55,553 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-22 23:04:55,553 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-22 23:04:55,554 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-22 23:04:55,554 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-22 23:04:55,554 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-22 23:04:55,554 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-22 23:04:55,554 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-22 23:04:55,554 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-22 23:04:55,554 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-22 23:04:55,573 INFO L276 IsEmpty]: Start isEmpty. Operand 138 states. [2018-11-22 23:04:55,580 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 31 [2018-11-22 23:04:55,580 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:55,581 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:55,583 INFO L423 AbstractCegarLoop]: === Iteration 1 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:55,588 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:55,589 INFO L82 PathProgramCache]: Analyzing trace with hash 500880985, now seen corresponding path program 1 times [2018-11-22 23:04:55,590 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:55,591 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:55,631 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:55,631 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:55,631 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:55,713 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:55,806 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-22 23:04:55,808 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:55,808 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-22 23:04:55,811 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-22 23:04:55,819 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-22 23:04:55,819 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:04:55,821 INFO L87 Difference]: Start difference. First operand 138 states. Second operand 3 states. [2018-11-22 23:04:55,931 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:55,932 INFO L93 Difference]: Finished difference Result 379 states and 634 transitions. [2018-11-22 23:04:55,932 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-22 23:04:55,934 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 30 [2018-11-22 23:04:55,934 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:55,947 INFO L225 Difference]: With dead ends: 379 [2018-11-22 23:04:55,947 INFO L226 Difference]: Without dead ends: 219 [2018-11-22 23:04:55,951 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:04:55,970 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 219 states. [2018-11-22 23:04:56,000 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 219 to 219. [2018-11-22 23:04:56,001 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 219 states. [2018-11-22 23:04:56,004 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 219 states to 219 states and 323 transitions. [2018-11-22 23:04:56,006 INFO L78 Accepts]: Start accepts. Automaton has 219 states and 323 transitions. Word has length 30 [2018-11-22 23:04:56,007 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:56,007 INFO L480 AbstractCegarLoop]: Abstraction has 219 states and 323 transitions. [2018-11-22 23:04:56,007 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-22 23:04:56,007 INFO L276 IsEmpty]: Start isEmpty. Operand 219 states and 323 transitions. [2018-11-22 23:04:56,009 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 46 [2018-11-22 23:04:56,010 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:56,010 INFO L402 BasicCegarLoop]: trace histogram [2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:56,010 INFO L423 AbstractCegarLoop]: === Iteration 2 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:56,010 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:56,011 INFO L82 PathProgramCache]: Analyzing trace with hash -1966298573, now seen corresponding path program 1 times [2018-11-22 23:04:56,011 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:56,011 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:56,012 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:56,013 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:56,013 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:56,044 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:56,109 INFO L134 CoverageAnalysis]: Checked inductivity of 8 backedges. 8 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-22 23:04:56,109 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:56,109 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-22 23:04:56,111 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-22 23:04:56,111 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-22 23:04:56,111 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:04:56,111 INFO L87 Difference]: Start difference. First operand 219 states and 323 transitions. Second operand 3 states. [2018-11-22 23:04:56,166 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:56,166 INFO L93 Difference]: Finished difference Result 423 states and 632 transitions. [2018-11-22 23:04:56,167 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-22 23:04:56,167 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-22 23:04:56,168 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:56,170 INFO L225 Difference]: With dead ends: 423 [2018-11-22 23:04:56,170 INFO L226 Difference]: Without dead ends: 318 [2018-11-22 23:04:56,172 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:04:56,172 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 318 states. [2018-11-22 23:04:56,189 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 318 to 318. [2018-11-22 23:04:56,189 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 318 states. [2018-11-22 23:04:56,191 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 318 states to 318 states and 469 transitions. [2018-11-22 23:04:56,192 INFO L78 Accepts]: Start accepts. Automaton has 318 states and 469 transitions. Word has length 45 [2018-11-22 23:04:56,192 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:56,192 INFO L480 AbstractCegarLoop]: Abstraction has 318 states and 469 transitions. [2018-11-22 23:04:56,192 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-22 23:04:56,193 INFO L276 IsEmpty]: Start isEmpty. Operand 318 states and 469 transitions. [2018-11-22 23:04:56,196 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-22 23:04:56,196 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:56,196 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:56,196 INFO L423 AbstractCegarLoop]: === Iteration 3 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:56,197 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:56,197 INFO L82 PathProgramCache]: Analyzing trace with hash 4919250, now seen corresponding path program 1 times [2018-11-22 23:04:56,198 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:56,198 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:56,199 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:56,199 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:56,199 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:56,233 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:56,333 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:56,334 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:56,334 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:56,334 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:56,335 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:56,335 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:56,335 INFO L87 Difference]: Start difference. First operand 318 states and 469 transitions. Second operand 4 states. [2018-11-22 23:04:56,703 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:56,703 INFO L93 Difference]: Finished difference Result 809 states and 1200 transitions. [2018-11-22 23:04:56,704 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:56,704 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 63 [2018-11-22 23:04:56,704 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:56,705 INFO L225 Difference]: With dead ends: 809 [2018-11-22 23:04:56,706 INFO L226 Difference]: Without dead ends: 504 [2018-11-22 23:04:56,707 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:56,707 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 504 states. [2018-11-22 23:04:56,720 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 504 to 368. [2018-11-22 23:04:56,720 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 368 states. [2018-11-22 23:04:56,722 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 368 states to 368 states and 555 transitions. [2018-11-22 23:04:56,722 INFO L78 Accepts]: Start accepts. Automaton has 368 states and 555 transitions. Word has length 63 [2018-11-22 23:04:56,723 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:56,723 INFO L480 AbstractCegarLoop]: Abstraction has 368 states and 555 transitions. [2018-11-22 23:04:56,723 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:56,723 INFO L276 IsEmpty]: Start isEmpty. Operand 368 states and 555 transitions. [2018-11-22 23:04:56,726 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-22 23:04:56,726 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:56,727 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:56,727 INFO L423 AbstractCegarLoop]: === Iteration 4 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:56,727 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:56,727 INFO L82 PathProgramCache]: Analyzing trace with hash -129094256, now seen corresponding path program 1 times [2018-11-22 23:04:56,727 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:56,728 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:56,729 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:56,729 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:56,729 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:56,753 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:56,817 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:56,818 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:56,818 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:56,818 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:56,818 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:56,819 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:56,819 INFO L87 Difference]: Start difference. First operand 368 states and 555 transitions. Second operand 4 states. [2018-11-22 23:04:57,132 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:57,132 INFO L93 Difference]: Finished difference Result 809 states and 1221 transitions. [2018-11-22 23:04:57,137 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:57,137 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 63 [2018-11-22 23:04:57,138 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:57,139 INFO L225 Difference]: With dead ends: 809 [2018-11-22 23:04:57,140 INFO L226 Difference]: Without dead ends: 454 [2018-11-22 23:04:57,141 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:57,142 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 454 states. [2018-11-22 23:04:57,154 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 454 to 408. [2018-11-22 23:04:57,154 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 408 states. [2018-11-22 23:04:57,156 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 408 states to 408 states and 623 transitions. [2018-11-22 23:04:57,156 INFO L78 Accepts]: Start accepts. Automaton has 408 states and 623 transitions. Word has length 63 [2018-11-22 23:04:57,157 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:57,157 INFO L480 AbstractCegarLoop]: Abstraction has 408 states and 623 transitions. [2018-11-22 23:04:57,157 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:57,157 INFO L276 IsEmpty]: Start isEmpty. Operand 408 states and 623 transitions. [2018-11-22 23:04:57,159 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 65 [2018-11-22 23:04:57,159 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:57,159 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:57,159 INFO L423 AbstractCegarLoop]: === Iteration 5 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:57,159 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:57,159 INFO L82 PathProgramCache]: Analyzing trace with hash 147810951, now seen corresponding path program 1 times [2018-11-22 23:04:57,160 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:57,160 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:57,163 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:57,163 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:57,163 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:57,185 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:57,247 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:57,247 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:57,247 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:57,248 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:57,248 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:57,248 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:57,248 INFO L87 Difference]: Start difference. First operand 408 states and 623 transitions. Second operand 4 states. [2018-11-22 23:04:57,655 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:57,655 INFO L93 Difference]: Finished difference Result 931 states and 1412 transitions. [2018-11-22 23:04:57,656 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:57,656 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 64 [2018-11-22 23:04:57,657 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:57,659 INFO L225 Difference]: With dead ends: 931 [2018-11-22 23:04:57,659 INFO L226 Difference]: Without dead ends: 536 [2018-11-22 23:04:57,660 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:57,661 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 536 states. [2018-11-22 23:04:57,671 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 536 to 410. [2018-11-22 23:04:57,671 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:04:57,673 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 625 transitions. [2018-11-22 23:04:57,673 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 625 transitions. Word has length 64 [2018-11-22 23:04:57,673 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:57,674 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 625 transitions. [2018-11-22 23:04:57,674 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:57,674 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 625 transitions. [2018-11-22 23:04:57,675 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 78 [2018-11-22 23:04:57,675 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:57,675 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:57,675 INFO L423 AbstractCegarLoop]: === Iteration 6 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:57,675 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:57,676 INFO L82 PathProgramCache]: Analyzing trace with hash 765836586, now seen corresponding path program 1 times [2018-11-22 23:04:57,676 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:57,676 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:57,677 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:57,677 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:57,677 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:57,698 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:57,748 INFO L134 CoverageAnalysis]: Checked inductivity of 44 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:57,748 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:57,748 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:57,749 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:57,749 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:57,749 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:57,749 INFO L87 Difference]: Start difference. First operand 410 states and 625 transitions. Second operand 4 states. [2018-11-22 23:04:58,136 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:58,136 INFO L93 Difference]: Finished difference Result 931 states and 1410 transitions. [2018-11-22 23:04:58,137 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:58,137 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 77 [2018-11-22 23:04:58,137 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:58,139 INFO L225 Difference]: With dead ends: 931 [2018-11-22 23:04:58,139 INFO L226 Difference]: Without dead ends: 534 [2018-11-22 23:04:58,140 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:58,141 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 534 states. [2018-11-22 23:04:58,148 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 534 to 410. [2018-11-22 23:04:58,148 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:04:58,149 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 623 transitions. [2018-11-22 23:04:58,149 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 623 transitions. Word has length 77 [2018-11-22 23:04:58,150 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:58,150 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 623 transitions. [2018-11-22 23:04:58,150 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:58,150 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 623 transitions. [2018-11-22 23:04:58,151 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 78 [2018-11-22 23:04:58,151 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:58,152 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:58,152 INFO L423 AbstractCegarLoop]: === Iteration 7 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:58,152 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:58,152 INFO L82 PathProgramCache]: Analyzing trace with hash -343143860, now seen corresponding path program 1 times [2018-11-22 23:04:58,152 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:58,152 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:58,155 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:58,155 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:58,155 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:58,171 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:58,215 INFO L134 CoverageAnalysis]: Checked inductivity of 47 backedges. 39 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:58,215 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:58,215 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:58,216 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:58,216 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:58,216 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:58,216 INFO L87 Difference]: Start difference. First operand 410 states and 623 transitions. Second operand 4 states. [2018-11-22 23:04:58,465 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:58,465 INFO L93 Difference]: Finished difference Result 931 states and 1406 transitions. [2018-11-22 23:04:58,466 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:58,466 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 77 [2018-11-22 23:04:58,466 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:58,467 INFO L225 Difference]: With dead ends: 931 [2018-11-22 23:04:58,467 INFO L226 Difference]: Without dead ends: 534 [2018-11-22 23:04:58,468 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:58,469 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 534 states. [2018-11-22 23:04:58,475 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 534 to 410. [2018-11-22 23:04:58,475 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:04:58,476 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 621 transitions. [2018-11-22 23:04:58,477 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 621 transitions. Word has length 77 [2018-11-22 23:04:58,477 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:58,477 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 621 transitions. [2018-11-22 23:04:58,477 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:58,477 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 621 transitions. [2018-11-22 23:04:58,478 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 78 [2018-11-22 23:04:58,478 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:58,478 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:58,478 INFO L423 AbstractCegarLoop]: === Iteration 8 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:58,478 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:58,479 INFO L82 PathProgramCache]: Analyzing trace with hash -263522712, now seen corresponding path program 1 times [2018-11-22 23:04:58,479 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:58,479 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:58,480 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:58,480 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:58,480 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:58,493 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:58,543 INFO L134 CoverageAnalysis]: Checked inductivity of 44 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:58,543 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:58,543 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:58,543 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:58,544 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:58,544 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:58,544 INFO L87 Difference]: Start difference. First operand 410 states and 621 transitions. Second operand 4 states. [2018-11-22 23:04:58,731 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:58,731 INFO L93 Difference]: Finished difference Result 851 states and 1281 transitions. [2018-11-22 23:04:58,731 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:58,731 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 77 [2018-11-22 23:04:58,732 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:58,733 INFO L225 Difference]: With dead ends: 851 [2018-11-22 23:04:58,733 INFO L226 Difference]: Without dead ends: 454 [2018-11-22 23:04:58,734 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:58,735 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 454 states. [2018-11-22 23:04:58,741 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 454 to 410. [2018-11-22 23:04:58,741 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:04:58,742 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 619 transitions. [2018-11-22 23:04:58,743 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 619 transitions. Word has length 77 [2018-11-22 23:04:58,743 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:58,743 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 619 transitions. [2018-11-22 23:04:58,743 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:58,743 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 619 transitions. [2018-11-22 23:04:58,744 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 78 [2018-11-22 23:04:58,744 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:58,744 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:58,744 INFO L423 AbstractCegarLoop]: === Iteration 9 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:58,745 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:58,745 INFO L82 PathProgramCache]: Analyzing trace with hash -1372503158, now seen corresponding path program 1 times [2018-11-22 23:04:58,745 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:58,745 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:58,746 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:58,746 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:58,746 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:58,758 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:58,794 INFO L134 CoverageAnalysis]: Checked inductivity of 47 backedges. 39 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:58,795 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:58,795 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:58,795 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:58,795 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:58,795 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:58,796 INFO L87 Difference]: Start difference. First operand 410 states and 619 transitions. Second operand 4 states. [2018-11-22 23:04:58,973 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:58,973 INFO L93 Difference]: Finished difference Result 851 states and 1277 transitions. [2018-11-22 23:04:58,974 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:58,974 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 77 [2018-11-22 23:04:58,974 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:58,975 INFO L225 Difference]: With dead ends: 851 [2018-11-22 23:04:58,975 INFO L226 Difference]: Without dead ends: 454 [2018-11-22 23:04:58,976 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:58,977 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 454 states. [2018-11-22 23:04:58,983 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 454 to 410. [2018-11-22 23:04:58,984 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:04:58,984 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 617 transitions. [2018-11-22 23:04:58,985 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 617 transitions. Word has length 77 [2018-11-22 23:04:58,985 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:58,985 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 617 transitions. [2018-11-22 23:04:58,985 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:58,985 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 617 transitions. [2018-11-22 23:04:58,986 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-22 23:04:58,986 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:58,986 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:58,987 INFO L423 AbstractCegarLoop]: === Iteration 10 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:58,987 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:58,987 INFO L82 PathProgramCache]: Analyzing trace with hash -1993132031, now seen corresponding path program 1 times [2018-11-22 23:04:58,987 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:58,987 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:58,988 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:58,988 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:58,988 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:59,000 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:59,041 INFO L134 CoverageAnalysis]: Checked inductivity of 50 backedges. 42 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:59,041 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:59,042 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:59,042 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:59,042 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:59,042 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:59,042 INFO L87 Difference]: Start difference. First operand 410 states and 617 transitions. Second operand 4 states. [2018-11-22 23:04:59,315 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:59,315 INFO L93 Difference]: Finished difference Result 931 states and 1394 transitions. [2018-11-22 23:04:59,316 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:59,316 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-22 23:04:59,316 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:59,318 INFO L225 Difference]: With dead ends: 931 [2018-11-22 23:04:59,318 INFO L226 Difference]: Without dead ends: 534 [2018-11-22 23:04:59,319 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:59,319 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 534 states. [2018-11-22 23:04:59,328 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 534 to 410. [2018-11-22 23:04:59,328 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:04:59,331 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 615 transitions. [2018-11-22 23:04:59,331 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 615 transitions. Word has length 78 [2018-11-22 23:04:59,331 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:59,331 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 615 transitions. [2018-11-22 23:04:59,332 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:59,332 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 615 transitions. [2018-11-22 23:04:59,333 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-22 23:04:59,333 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:59,333 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:59,333 INFO L423 AbstractCegarLoop]: === Iteration 11 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:59,333 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:59,334 INFO L82 PathProgramCache]: Analyzing trace with hash -1693070948, now seen corresponding path program 1 times [2018-11-22 23:04:59,334 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:59,334 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:59,335 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:59,335 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:59,335 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:59,348 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:59,396 INFO L134 CoverageAnalysis]: Checked inductivity of 63 backedges. 55 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:59,396 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:59,396 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:59,396 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:59,397 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:59,397 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:59,397 INFO L87 Difference]: Start difference. First operand 410 states and 615 transitions. Second operand 4 states. [2018-11-22 23:04:59,661 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:59,661 INFO L93 Difference]: Finished difference Result 786 states and 1171 transitions. [2018-11-22 23:04:59,662 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:59,662 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-22 23:04:59,662 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:59,663 INFO L225 Difference]: With dead ends: 786 [2018-11-22 23:04:59,663 INFO L226 Difference]: Without dead ends: 534 [2018-11-22 23:04:59,664 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:59,665 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 534 states. [2018-11-22 23:04:59,672 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 534 to 410. [2018-11-22 23:04:59,672 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:04:59,673 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 613 transitions. [2018-11-22 23:04:59,673 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 613 transitions. Word has length 78 [2018-11-22 23:04:59,673 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:59,673 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 613 transitions. [2018-11-22 23:04:59,673 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:59,674 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 613 transitions. [2018-11-22 23:04:59,674 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-22 23:04:59,674 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:59,675 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:59,675 INFO L423 AbstractCegarLoop]: === Iteration 12 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:59,675 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:59,675 INFO L82 PathProgramCache]: Analyzing trace with hash 456468099, now seen corresponding path program 1 times [2018-11-22 23:04:59,675 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:59,675 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:59,676 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:59,676 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:59,676 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:59,688 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:04:59,717 INFO L134 CoverageAnalysis]: Checked inductivity of 50 backedges. 42 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:04:59,717 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:04:59,717 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:04:59,717 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:04:59,717 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:04:59,717 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:04:59,718 INFO L87 Difference]: Start difference. First operand 410 states and 613 transitions. Second operand 4 states. [2018-11-22 23:04:59,916 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:04:59,916 INFO L93 Difference]: Finished difference Result 851 states and 1265 transitions. [2018-11-22 23:04:59,917 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:04:59,917 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-22 23:04:59,917 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:04:59,918 INFO L225 Difference]: With dead ends: 851 [2018-11-22 23:04:59,918 INFO L226 Difference]: Without dead ends: 454 [2018-11-22 23:04:59,919 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:04:59,920 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 454 states. [2018-11-22 23:04:59,927 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 454 to 410. [2018-11-22 23:04:59,928 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:04:59,929 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 611 transitions. [2018-11-22 23:04:59,929 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 611 transitions. Word has length 78 [2018-11-22 23:04:59,929 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:04:59,929 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 611 transitions. [2018-11-22 23:04:59,929 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:04:59,929 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 611 transitions. [2018-11-22 23:04:59,930 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-22 23:04:59,930 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:04:59,931 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:04:59,931 INFO L423 AbstractCegarLoop]: === Iteration 13 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:04:59,931 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:04:59,931 INFO L82 PathProgramCache]: Analyzing trace with hash 756529182, now seen corresponding path program 1 times [2018-11-22 23:04:59,931 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:04:59,931 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:04:59,932 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:59,932 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:04:59,932 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:04:59,944 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:00,021 INFO L134 CoverageAnalysis]: Checked inductivity of 63 backedges. 55 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:05:00,021 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:00,021 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:05:00,021 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:05:00,021 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:05:00,021 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:05:00,022 INFO L87 Difference]: Start difference. First operand 410 states and 611 transitions. Second operand 4 states. [2018-11-22 23:05:00,192 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:00,192 INFO L93 Difference]: Finished difference Result 706 states and 1044 transitions. [2018-11-22 23:05:00,193 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:05:00,193 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-22 23:05:00,193 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:00,194 INFO L225 Difference]: With dead ends: 706 [2018-11-22 23:05:00,194 INFO L226 Difference]: Without dead ends: 454 [2018-11-22 23:05:00,195 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:05:00,196 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 454 states. [2018-11-22 23:05:00,203 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 454 to 410. [2018-11-22 23:05:00,203 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:05:00,204 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 609 transitions. [2018-11-22 23:05:00,204 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 609 transitions. Word has length 78 [2018-11-22 23:05:00,205 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:00,205 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 609 transitions. [2018-11-22 23:05:00,205 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:05:00,205 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 609 transitions. [2018-11-22 23:05:00,206 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-22 23:05:00,206 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:00,206 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:00,206 INFO L423 AbstractCegarLoop]: === Iteration 14 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:00,206 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:00,207 INFO L82 PathProgramCache]: Analyzing trace with hash -1546577145, now seen corresponding path program 1 times [2018-11-22 23:05:00,207 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:00,207 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:00,207 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:00,208 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:00,208 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:00,218 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:00,256 INFO L134 CoverageAnalysis]: Checked inductivity of 53 backedges. 45 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:05:00,256 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:00,256 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:05:00,257 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:05:00,257 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:05:00,257 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:05:00,257 INFO L87 Difference]: Start difference. First operand 410 states and 609 transitions. Second operand 4 states. [2018-11-22 23:05:00,506 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:00,506 INFO L93 Difference]: Finished difference Result 931 states and 1378 transitions. [2018-11-22 23:05:00,506 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:05:00,506 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-22 23:05:00,507 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:00,508 INFO L225 Difference]: With dead ends: 931 [2018-11-22 23:05:00,508 INFO L226 Difference]: Without dead ends: 534 [2018-11-22 23:05:00,509 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:05:00,510 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 534 states. [2018-11-22 23:05:00,518 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 534 to 410. [2018-11-22 23:05:00,518 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:05:00,519 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 607 transitions. [2018-11-22 23:05:00,519 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 607 transitions. Word has length 79 [2018-11-22 23:05:00,519 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:00,519 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 607 transitions. [2018-11-22 23:05:00,519 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:05:00,519 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 607 transitions. [2018-11-22 23:05:00,520 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-22 23:05:00,520 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:00,520 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:00,521 INFO L423 AbstractCegarLoop]: === Iteration 15 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:00,521 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:00,521 INFO L82 PathProgramCache]: Analyzing trace with hash 1458412487, now seen corresponding path program 1 times [2018-11-22 23:05:00,521 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:00,521 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:00,522 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:00,522 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:00,522 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:00,532 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:00,570 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 57 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:05:00,570 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:00,570 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:05:00,570 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:05:00,571 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:05:00,571 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:05:00,571 INFO L87 Difference]: Start difference. First operand 410 states and 607 transitions. Second operand 4 states. [2018-11-22 23:05:00,843 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:00,843 INFO L93 Difference]: Finished difference Result 780 states and 1152 transitions. [2018-11-22 23:05:00,844 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:05:00,844 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-22 23:05:00,844 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:00,845 INFO L225 Difference]: With dead ends: 780 [2018-11-22 23:05:00,845 INFO L226 Difference]: Without dead ends: 528 [2018-11-22 23:05:00,846 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:05:00,847 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 528 states. [2018-11-22 23:05:00,854 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 528 to 410. [2018-11-22 23:05:00,854 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:05:00,855 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 605 transitions. [2018-11-22 23:05:00,855 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 605 transitions. Word has length 79 [2018-11-22 23:05:00,855 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:00,856 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 605 transitions. [2018-11-22 23:05:00,856 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:05:00,856 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 605 transitions. [2018-11-22 23:05:00,857 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-22 23:05:00,857 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:00,857 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:00,857 INFO L423 AbstractCegarLoop]: === Iteration 16 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:00,857 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:00,857 INFO L82 PathProgramCache]: Analyzing trace with hash 1376582853, now seen corresponding path program 1 times [2018-11-22 23:05:00,857 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:00,857 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:00,858 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:00,858 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:00,858 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:00,867 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:00,892 INFO L134 CoverageAnalysis]: Checked inductivity of 53 backedges. 45 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:05:00,892 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:00,892 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:05:00,892 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:05:00,892 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:05:00,893 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:05:00,893 INFO L87 Difference]: Start difference. First operand 410 states and 605 transitions. Second operand 4 states. [2018-11-22 23:05:01,067 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:01,067 INFO L93 Difference]: Finished difference Result 851 states and 1249 transitions. [2018-11-22 23:05:01,068 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:05:01,068 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-22 23:05:01,068 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:01,070 INFO L225 Difference]: With dead ends: 851 [2018-11-22 23:05:01,070 INFO L226 Difference]: Without dead ends: 454 [2018-11-22 23:05:01,071 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:05:01,071 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 454 states. [2018-11-22 23:05:01,079 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 454 to 410. [2018-11-22 23:05:01,080 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:05:01,080 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 603 transitions. [2018-11-22 23:05:01,081 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 603 transitions. Word has length 79 [2018-11-22 23:05:01,081 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:01,081 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 603 transitions. [2018-11-22 23:05:01,081 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:05:01,081 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 603 transitions. [2018-11-22 23:05:01,082 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-22 23:05:01,082 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:01,083 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:01,083 INFO L423 AbstractCegarLoop]: === Iteration 17 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:01,083 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:01,083 INFO L82 PathProgramCache]: Analyzing trace with hash 86605189, now seen corresponding path program 1 times [2018-11-22 23:05:01,083 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:01,083 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:01,084 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:01,084 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:01,084 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:01,095 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:01,123 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 57 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:05:01,123 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:01,124 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:05:01,124 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:05:01,124 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:05:01,124 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:05:01,124 INFO L87 Difference]: Start difference. First operand 410 states and 603 transitions. Second operand 4 states. [2018-11-22 23:05:01,293 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:01,293 INFO L93 Difference]: Finished difference Result 700 states and 1025 transitions. [2018-11-22 23:05:01,294 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:05:01,294 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-22 23:05:01,294 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:01,295 INFO L225 Difference]: With dead ends: 700 [2018-11-22 23:05:01,295 INFO L226 Difference]: Without dead ends: 448 [2018-11-22 23:05:01,296 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:05:01,296 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 448 states. [2018-11-22 23:05:01,305 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 448 to 410. [2018-11-22 23:05:01,305 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:05:01,306 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 601 transitions. [2018-11-22 23:05:01,306 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 601 transitions. Word has length 79 [2018-11-22 23:05:01,306 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:01,306 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 601 transitions. [2018-11-22 23:05:01,306 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:05:01,306 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 601 transitions. [2018-11-22 23:05:01,307 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 81 [2018-11-22 23:05:01,307 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:01,308 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:01,308 INFO L423 AbstractCegarLoop]: === Iteration 18 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:01,308 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:01,308 INFO L82 PathProgramCache]: Analyzing trace with hash -531696932, now seen corresponding path program 1 times [2018-11-22 23:05:01,308 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:01,308 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:01,309 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:01,309 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:01,309 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:01,337 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:01,390 INFO L134 CoverageAnalysis]: Checked inductivity of 56 backedges. 48 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:05:01,391 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:01,391 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:05:01,391 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:05:01,391 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:05:01,391 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:05:01,392 INFO L87 Difference]: Start difference. First operand 410 states and 601 transitions. Second operand 4 states. [2018-11-22 23:05:01,712 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:01,713 INFO L93 Difference]: Finished difference Result 907 states and 1333 transitions. [2018-11-22 23:05:01,713 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:05:01,713 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 80 [2018-11-22 23:05:01,713 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:01,714 INFO L225 Difference]: With dead ends: 907 [2018-11-22 23:05:01,714 INFO L226 Difference]: Without dead ends: 510 [2018-11-22 23:05:01,715 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:05:01,715 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 510 states. [2018-11-22 23:05:01,729 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 510 to 410. [2018-11-22 23:05:01,729 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:05:01,730 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 599 transitions. [2018-11-22 23:05:01,731 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 599 transitions. Word has length 80 [2018-11-22 23:05:01,731 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:01,731 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 599 transitions. [2018-11-22 23:05:01,731 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:05:01,731 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 599 transitions. [2018-11-22 23:05:01,732 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 81 [2018-11-22 23:05:01,732 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:01,732 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:01,733 INFO L423 AbstractCegarLoop]: === Iteration 19 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:01,733 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:01,733 INFO L82 PathProgramCache]: Analyzing trace with hash -108050210, now seen corresponding path program 1 times [2018-11-22 23:05:01,733 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:01,733 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:01,734 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:01,734 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:01,734 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:01,748 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:01,806 INFO L134 CoverageAnalysis]: Checked inductivity of 56 backedges. 48 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:05:01,806 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:01,807 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:05:01,807 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:05:01,807 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:05:01,807 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:05:01,807 INFO L87 Difference]: Start difference. First operand 410 states and 599 transitions. Second operand 4 states. [2018-11-22 23:05:02,013 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:02,013 INFO L93 Difference]: Finished difference Result 827 states and 1208 transitions. [2018-11-22 23:05:02,014 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:05:02,015 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 80 [2018-11-22 23:05:02,015 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:02,016 INFO L225 Difference]: With dead ends: 827 [2018-11-22 23:05:02,016 INFO L226 Difference]: Without dead ends: 430 [2018-11-22 23:05:02,017 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:05:02,018 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 430 states. [2018-11-22 23:05:02,029 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 430 to 410. [2018-11-22 23:05:02,029 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:05:02,030 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 597 transitions. [2018-11-22 23:05:02,030 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 597 transitions. Word has length 80 [2018-11-22 23:05:02,031 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:02,031 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 597 transitions. [2018-11-22 23:05:02,031 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:05:02,031 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 597 transitions. [2018-11-22 23:05:02,032 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-22 23:05:02,032 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:02,032 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:02,032 INFO L423 AbstractCegarLoop]: === Iteration 20 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:02,032 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:02,032 INFO L82 PathProgramCache]: Analyzing trace with hash -260577949, now seen corresponding path program 1 times [2018-11-22 23:05:02,033 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:02,033 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:02,033 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:02,034 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:02,034 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:02,046 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:02,079 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 57 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:05:02,080 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:02,080 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-22 23:05:02,080 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-22 23:05:02,080 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-22 23:05:02,080 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-22 23:05:02,081 INFO L87 Difference]: Start difference. First operand 410 states and 597 transitions. Second operand 4 states. [2018-11-22 23:05:02,378 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:02,379 INFO L93 Difference]: Finished difference Result 907 states and 1325 transitions. [2018-11-22 23:05:02,379 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-22 23:05:02,379 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 81 [2018-11-22 23:05:02,379 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:02,381 INFO L225 Difference]: With dead ends: 907 [2018-11-22 23:05:02,381 INFO L226 Difference]: Without dead ends: 510 [2018-11-22 23:05:02,382 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-22 23:05:02,382 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 510 states. [2018-11-22 23:05:02,390 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 510 to 410. [2018-11-22 23:05:02,390 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 410 states. [2018-11-22 23:05:02,391 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 410 states to 410 states and 595 transitions. [2018-11-22 23:05:02,391 INFO L78 Accepts]: Start accepts. Automaton has 410 states and 595 transitions. Word has length 81 [2018-11-22 23:05:02,391 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:02,391 INFO L480 AbstractCegarLoop]: Abstraction has 410 states and 595 transitions. [2018-11-22 23:05:02,391 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-22 23:05:02,392 INFO L276 IsEmpty]: Start isEmpty. Operand 410 states and 595 transitions. [2018-11-22 23:05:02,393 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-22 23:05:02,393 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:02,393 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:02,393 INFO L423 AbstractCegarLoop]: === Iteration 21 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:02,393 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:02,393 INFO L82 PathProgramCache]: Analyzing trace with hash -12431455, now seen corresponding path program 1 times [2018-11-22 23:05:02,394 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:02,394 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:02,394 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:02,394 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:02,395 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:02,406 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:02,444 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 42 proven. 0 refuted. 0 times theorem prover too weak. 23 trivial. 0 not checked. [2018-11-22 23:05:02,444 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:02,444 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-22 23:05:02,445 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-22 23:05:02,445 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-22 23:05:02,445 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:02,445 INFO L87 Difference]: Start difference. First operand 410 states and 595 transitions. Second operand 3 states. [2018-11-22 23:05:02,472 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:02,472 INFO L93 Difference]: Finished difference Result 809 states and 1182 transitions. [2018-11-22 23:05:02,472 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-22 23:05:02,473 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 81 [2018-11-22 23:05:02,473 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:02,474 INFO L225 Difference]: With dead ends: 809 [2018-11-22 23:05:02,474 INFO L226 Difference]: Without dead ends: 559 [2018-11-22 23:05:02,475 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:02,475 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 559 states. [2018-11-22 23:05:02,484 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 559 to 559. [2018-11-22 23:05:02,484 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 559 states. [2018-11-22 23:05:02,485 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 559 states to 559 states and 812 transitions. [2018-11-22 23:05:02,485 INFO L78 Accepts]: Start accepts. Automaton has 559 states and 812 transitions. Word has length 81 [2018-11-22 23:05:02,485 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:02,485 INFO L480 AbstractCegarLoop]: Abstraction has 559 states and 812 transitions. [2018-11-22 23:05:02,485 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-22 23:05:02,486 INFO L276 IsEmpty]: Start isEmpty. Operand 559 states and 812 transitions. [2018-11-22 23:05:02,487 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 84 [2018-11-22 23:05:02,487 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:02,487 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:02,487 INFO L423 AbstractCegarLoop]: === Iteration 22 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:02,487 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:02,487 INFO L82 PathProgramCache]: Analyzing trace with hash -427077033, now seen corresponding path program 1 times [2018-11-22 23:05:02,487 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:02,487 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:02,488 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:02,488 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:02,488 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:02,498 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:02,531 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 29 trivial. 0 not checked. [2018-11-22 23:05:02,531 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:02,531 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-22 23:05:02,532 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-22 23:05:02,532 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-22 23:05:02,532 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:02,532 INFO L87 Difference]: Start difference. First operand 559 states and 812 transitions. Second operand 3 states. [2018-11-22 23:05:02,568 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:02,568 INFO L93 Difference]: Finished difference Result 1107 states and 1616 transitions. [2018-11-22 23:05:02,569 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-22 23:05:02,570 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 83 [2018-11-22 23:05:02,570 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:02,572 INFO L225 Difference]: With dead ends: 1107 [2018-11-22 23:05:02,572 INFO L226 Difference]: Without dead ends: 708 [2018-11-22 23:05:02,573 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:02,574 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 708 states. [2018-11-22 23:05:02,585 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 708 to 708. [2018-11-22 23:05:02,585 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 708 states. [2018-11-22 23:05:02,586 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 708 states to 708 states and 1030 transitions. [2018-11-22 23:05:02,586 INFO L78 Accepts]: Start accepts. Automaton has 708 states and 1030 transitions. Word has length 83 [2018-11-22 23:05:02,586 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:02,587 INFO L480 AbstractCegarLoop]: Abstraction has 708 states and 1030 transitions. [2018-11-22 23:05:02,587 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-22 23:05:02,587 INFO L276 IsEmpty]: Start isEmpty. Operand 708 states and 1030 transitions. [2018-11-22 23:05:02,588 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 105 [2018-11-22 23:05:02,588 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:02,588 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:02,589 INFO L423 AbstractCegarLoop]: === Iteration 23 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:02,589 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:02,589 INFO L82 PathProgramCache]: Analyzing trace with hash -1175788506, now seen corresponding path program 1 times [2018-11-22 23:05:02,589 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:02,589 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:02,590 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:02,590 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:02,590 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:02,609 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:02,685 INFO L134 CoverageAnalysis]: Checked inductivity of 118 backedges. 32 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-22 23:05:02,686 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:02,686 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2018-11-22 23:05:02,686 INFO L459 AbstractCegarLoop]: Interpolant automaton has 6 states [2018-11-22 23:05:02,686 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2018-11-22 23:05:02,686 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=11, Invalid=19, Unknown=0, NotChecked=0, Total=30 [2018-11-22 23:05:02,687 INFO L87 Difference]: Start difference. First operand 708 states and 1030 transitions. Second operand 6 states. [2018-11-22 23:05:03,048 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:03,048 INFO L93 Difference]: Finished difference Result 1341 states and 1956 transitions. [2018-11-22 23:05:03,049 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 6 states. [2018-11-22 23:05:03,049 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 104 [2018-11-22 23:05:03,049 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:03,051 INFO L225 Difference]: With dead ends: 1341 [2018-11-22 23:05:03,051 INFO L226 Difference]: Without dead ends: 791 [2018-11-22 23:05:03,052 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 10 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 6 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=33, Unknown=0, NotChecked=0, Total=56 [2018-11-22 23:05:03,053 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 791 states. [2018-11-22 23:05:03,071 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 791 to 716. [2018-11-22 23:05:03,071 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 716 states. [2018-11-22 23:05:03,073 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 716 states to 716 states and 1043 transitions. [2018-11-22 23:05:03,073 INFO L78 Accepts]: Start accepts. Automaton has 716 states and 1043 transitions. Word has length 104 [2018-11-22 23:05:03,073 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:03,073 INFO L480 AbstractCegarLoop]: Abstraction has 716 states and 1043 transitions. [2018-11-22 23:05:03,073 INFO L481 AbstractCegarLoop]: Interpolant automaton has 6 states. [2018-11-22 23:05:03,074 INFO L276 IsEmpty]: Start isEmpty. Operand 716 states and 1043 transitions. [2018-11-22 23:05:03,075 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 106 [2018-11-22 23:05:03,076 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:03,076 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:03,076 INFO L423 AbstractCegarLoop]: === Iteration 24 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:03,076 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:03,076 INFO L82 PathProgramCache]: Analyzing trace with hash 953389165, now seen corresponding path program 1 times [2018-11-22 23:05:03,076 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:03,077 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:03,078 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:03,078 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:03,078 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:03,104 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:03,270 INFO L134 CoverageAnalysis]: Checked inductivity of 122 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-22 23:05:03,270 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:03,270 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2018-11-22 23:05:03,270 INFO L459 AbstractCegarLoop]: Interpolant automaton has 6 states [2018-11-22 23:05:03,270 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2018-11-22 23:05:03,270 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=11, Invalid=19, Unknown=0, NotChecked=0, Total=30 [2018-11-22 23:05:03,271 INFO L87 Difference]: Start difference. First operand 716 states and 1043 transitions. Second operand 6 states. [2018-11-22 23:05:03,712 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:03,712 INFO L93 Difference]: Finished difference Result 1338 states and 1952 transitions. [2018-11-22 23:05:03,714 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 6 states. [2018-11-22 23:05:03,714 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 105 [2018-11-22 23:05:03,714 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:03,716 INFO L225 Difference]: With dead ends: 1338 [2018-11-22 23:05:03,717 INFO L226 Difference]: Without dead ends: 788 [2018-11-22 23:05:03,718 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 10 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 6 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=23, Invalid=33, Unknown=0, NotChecked=0, Total=56 [2018-11-22 23:05:03,719 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 788 states. [2018-11-22 23:05:03,737 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 788 to 717. [2018-11-22 23:05:03,738 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 717 states. [2018-11-22 23:05:03,739 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 717 states to 717 states and 1044 transitions. [2018-11-22 23:05:03,739 INFO L78 Accepts]: Start accepts. Automaton has 717 states and 1044 transitions. Word has length 105 [2018-11-22 23:05:03,740 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:03,740 INFO L480 AbstractCegarLoop]: Abstraction has 717 states and 1044 transitions. [2018-11-22 23:05:03,740 INFO L481 AbstractCegarLoop]: Interpolant automaton has 6 states. [2018-11-22 23:05:03,740 INFO L276 IsEmpty]: Start isEmpty. Operand 717 states and 1044 transitions. [2018-11-22 23:05:03,743 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 119 [2018-11-22 23:05:03,743 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:03,744 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:03,744 INFO L423 AbstractCegarLoop]: === Iteration 25 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:03,744 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:03,744 INFO L82 PathProgramCache]: Analyzing trace with hash 2127944510, now seen corresponding path program 1 times [2018-11-22 23:05:03,744 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-22 23:05:03,744 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-22 23:05:03,745 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:03,745 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:03,745 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-22 23:05:03,955 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-22 23:05:04,032 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-22 23:05:04,077 INFO L469 BasicCegarLoop]: Counterexample might be feasible ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=20503, |#NULL.offset|=20527, |old(#NULL.base)|=20503, |old(#NULL.offset)|=20527, |old(~#SSLv3_client_data~0.base)|=20490, |old(~#SSLv3_client_data~0.offset)|=20486, |old(~init~0)|=20533, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=20486, ~init~0=20533] [?] #NULL.base, #NULL.offset := 0, 0;#valid := #valid[0 := 0];~init~0 := 1;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100);call write~init~int(0, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 4 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 8 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 12 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 16 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 20 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 24 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 28 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 32 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 36 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 40 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 44 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 48 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 52 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 56 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 60 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 64 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 68 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 72 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 76 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 80 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 84 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 88 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 92 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 96 + ~#SSLv3_client_data~0.offset, 4); VAL [|#NULL.base|=0, |#NULL.offset|=0, |old(#NULL.base)|=20503, |old(#NULL.offset)|=20527, |old(~#SSLv3_client_data~0.base)|=20490, |old(~#SSLv3_client_data~0.offset)|=20486, |old(~init~0)|=20533, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume true; VAL [|#NULL.base|=0, |#NULL.offset|=0, |old(#NULL.base)|=20503, |old(#NULL.offset)|=20527, |old(~#SSLv3_client_data~0.base)|=20490, |old(~#SSLv3_client_data~0.offset)|=20486, |old(~init~0)|=20533, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] RET #544#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, 84 + ~s~0.offset, 4);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, 204 + ~s~0.offset, 4);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, 176 + ~s~0.offset, 4);call write~int(12292, ~s~0.base, 52 + ~s~0.offset, 4);assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647;call write~int(#t~nondet7, ~s~0.base, ~s~0.offset, 4);havoc #t~nondet7; VAL [main_~s~0.base=20498, main_~s~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |main_#t~malloc3.base|=20498, |main_#t~malloc3.offset|=0, |main_#t~malloc4.base|=20495, |main_#t~malloc4.offset|=0, |main_#t~malloc5.base|=20536, |main_#t~malloc5.offset|=0, |main_#t~malloc6.base|=20483, |main_#t~malloc6.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;assume -2147483648 <= #t~nondet15 && #t~nondet15 <= 2147483647;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;assume -2147483648 <= #t~nondet16 && #t~nondet16 <= 2147483647;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;assume -2147483648 <= #t~nondet17 && #t~nondet17 <= 2147483647;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;assume -2147483648 <= #t~nondet18 && #t~nondet18 <= 2147483647;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0;assume -2147483648 <= #t~nondet19 && #t~nondet19 <= 2147483647;call write~int(#t~nondet19, ~s.base, 92 + ~s.offset, 4);havoc #t~nondet19;call write~int(12292, ~s.base, 52 + ~s.offset, 4);assume -2147483648 <= #t~nondet20 && #t~nondet20 <= 2147483647;~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0, 0;~ret~0 := -1;~skip~0 := 0;call write~int(0, ~tmp___0~1.base, ~tmp___0~1.offset, 4);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=0, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem21.base|=1, |ssl3_connect_#t~mem21.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 0 != (#t~mem21.base + #t~mem21.offset) % 4294967296;havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem27 := read~int(~s.base, 28 + ~s.offset, 4);call write~int(1 + #t~mem27, ~s.base, 28 + ~s.offset, 4);havoc #t~mem27; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 != ~bitwiseAnd(~tmp___1~0, 12288)); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=12292, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 12292 == #t~mem29;havoc #t~mem29; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(1, ~s.base, 40 + ~s.offset, 4);call write~int(4096, ~s.base, 52 + ~s.offset, 4);call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4);call #t~mem63 := read~int(#t~mem62.base, 64 + #t~mem62.offset, 4);call write~int(1 + #t~mem63, #t~mem62.base, 64 + #t~mem62.offset, 4);havoc #t~mem63;havoc #t~mem62.base, #t~mem62.offset; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(0, ~s.base, 36 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 0 != (~cb~0.base + ~cb~0.offset) % 4294967296; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem64 := read~int(~s.base, ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem64|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(768 != ~bitwiseAnd(#t~mem64, 65280));havoc #t~mem64;call write~int(4096, ~s.base, 4 + ~s.offset, 4);call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, 60 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem65.base|=2, |ssl3_connect_#t~mem65.offset|=(- 1), |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == (#t~mem65.base + #t~mem65.offset) % 4294967296);havoc #t~mem65.base, #t~mem65.offset; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == ~tmp___4~0); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == ~tmp___5~0);call write~int(4368, ~s.base, 52 + ~s.offset, 4);call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4);call #t~mem68 := read~int(#t~mem67.base, 60 + #t~mem67.offset, 4);call write~int(1 + #t~mem68, #t~mem67.base, 60 + #t~mem67.offset, 4);havoc #t~mem68;havoc #t~mem67.base, #t~mem67.offset;call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem127.base|=20495, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20505, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4368, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4368, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem31|=4368, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem32|=4368, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem33|=4368, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem34|=4368, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4368 == #t~mem34;havoc #t~mem34; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(0, ~s.base, 48 + ~s.offset, 4);assume -2147483648 <= #t~nondet69 && #t~nondet69 <= 2147483647;~ret~0 := #t~nondet69;havoc #t~nondet69; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 0 == ~blastFlag~0;~blastFlag~0 := 1; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call write~int(4384, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, 20 + ~s.offset, 4);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, 16 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem70.base|=0, |ssl3_connect_#t~mem70.offset|=1, |ssl3_connect_#t~mem71.base|=0, |ssl3_connect_#t~mem71.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume (#t~mem70.base + #t~mem70.offset) % 4294967296 != (#t~mem71.base + #t~mem71.offset) % 4294967296;havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem127.base|=20495, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20505, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4384, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4384, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem31|=4384, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem32|=4384, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem33|=4384, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem34|=4384, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem35|=4384, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem36|=4384, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4384 == #t~mem36;havoc #t~mem36; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647;~ret~0 := #t~nondet72;havoc #t~nondet72; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 1 == ~blastFlag~0;~blastFlag~0 := 2; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call #t~mem73 := read~int(~s.base, 92 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem73|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 != #t~mem73);havoc #t~mem73;call write~int(4400, ~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem127.base|=20495, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20505, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem31|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem32|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem33|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem34|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem35|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem36|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem37|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem38|=4400, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4400 == #t~mem38;havoc #t~mem38; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, 836 + #t~mem74.offset, 4);call #t~mem76 := read~int(#t~mem75.base, 12 + #t~mem75.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem74.base|=20495, |ssl3_connect_#t~mem74.offset|=0, |ssl3_connect_#t~mem75.base|=20511, |ssl3_connect_#t~mem75.offset|=0, |ssl3_connect_#t~mem76|=20529, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 != ~bitwiseAnd(#t~mem76, 256) % 4294967296);havoc #t~mem74.base, #t~mem74.offset;havoc #t~mem75.base, #t~mem75.offset;havoc #t~mem76;assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647;~ret~0 := #t~nondet77;havoc #t~nondet77; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 2 == ~blastFlag~0;~blastFlag~0 := 3; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(4416, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem127.base|=20495, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20505, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem31|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem32|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem33|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem34|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem35|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem36|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem37|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem38|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4400 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem39|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4401 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem40|=4416, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4416 == #t~mem40;havoc #t~mem40; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet78 && #t~nondet78 <= 2147483647;~ret~0 := #t~nondet78;havoc #t~nondet78; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 3 == ~blastFlag~0;~blastFlag~0 := 4; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call write~int(4432, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == ~tmp___6~0); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem127.base|=20495, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20505, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem31|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem32|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem33|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem34|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem35|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem36|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem37|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem38|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4400 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem39|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4401 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem40|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4416 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem41|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4417 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem42|=4432, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4432 == #t~mem42;havoc #t~mem42; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet79 && #t~nondet79 <= 2147483647;~ret~0 := #t~nondet79;havoc #t~nondet79; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=0, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4 == ~blastFlag~0; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=0, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=0, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20498, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___3~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp___7~0=0, ssl3_connect_~tmp___8~0=0, ssl3_connect_~tmp___9~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=20503, #NULL.offset=20527, old(#NULL.base)=20503, old(#NULL.offset)=20527, old(~#SSLv3_client_data~0.base)=20490, old(~#SSLv3_client_data~0.offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=20486, ~init~0=20533] [?] #NULL.base, #NULL.offset := 0, 0; [?] #valid := #valid[0 := 0]; [L1042] ~init~0 := 1; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100); [L1043] call write~init~int(0, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 4 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 8 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 12 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 16 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 20 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 24 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 28 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 32 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 36 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 40 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 44 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 48 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 52 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 56 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 60 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 64 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 68 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 72 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 76 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 80 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 84 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 88 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 92 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 96 + ~#SSLv3_client_data~0.offset, 4); VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20503, old(#NULL.offset)=20527, old(~#SSLv3_client_data~0.base)=20490, old(~#SSLv3_client_data~0.offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] ensures true; VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20503, old(#NULL.offset)=20527, old(~#SSLv3_client_data~0.base)=20490, old(~#SSLv3_client_data~0.offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, 84 + ~s~0.offset, 4); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, 204 + ~s~0.offset, 4); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, 176 + ~s~0.offset, 4); [L1072] call write~int(12292, ~s~0.base, 52 + ~s~0.offset, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] call write~int(#t~nondet7, ~s~0.base, ~s~0.offset, 4); [L1073] havoc #t~nondet7; VAL [#NULL.base=0, #NULL.offset=0, #t~malloc3.base=20498, #t~malloc3.offset=0, #t~malloc4.base=20495, #t~malloc4.offset=0, #t~malloc5.base=20536, #t~malloc5.offset=0, #t~malloc6.base=20483, #t~malloc6.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1, ~s~0.base=20498, ~s~0.offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1079-L1645] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] havoc ~buf~0.base, ~buf~0.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset; [L1089] havoc #t~nondet9.base, #t~nondet9.offset; [L1090] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] assume -2147483648 <= #t~nondet15 && #t~nondet15 <= 2147483647; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] assume -2147483648 <= #t~nondet16 && #t~nondet16 <= 2147483647; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] assume -2147483648 <= #t~nondet17 && #t~nondet17 <= 2147483647; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] assume -2147483648 <= #t~nondet18 && #t~nondet18 <= 2147483647; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0; [L1103] assume -2147483648 <= #t~nondet19 && #t~nondet19 <= 2147483647; [L1103] call write~int(#t~nondet19, ~s.base, 92 + ~s.offset, 4); [L1103] havoc #t~nondet19; [L1104] call write~int(12292, ~s.base, 52 + ~s.offset, 4); [L1105] assume -2147483648 <= #t~nondet20 && #t~nondet20 <= 2147483647; [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0.base, ~cb~0.offset := 0, 0; [L1107] ~ret~0 := -1; [L1108] ~skip~0 := 0; [L1109] call write~int(0, ~tmp___0~1.base, ~tmp___0~1.offset, 4); [L1110] call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem21.base=1, #t~mem21.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=0, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1110-L1118] assume 0 != (#t~mem21.base + #t~mem21.offset) % 4294967296; [L1110] havoc #t~mem21.base, #t~mem21.offset; [L1111] call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset; [L1111] havoc #t~mem22.base, #t~mem22.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1119] call #t~mem27 := read~int(~s.base, 28 + ~s.offset, 4); [L1119] call write~int(1 + #t~mem27, ~s.base, 28 + ~s.offset, 4); [L1119] havoc #t~mem27; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1120-L1128] assume !(0 != ~bitwiseAnd(~tmp___1~0, 12288)); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=12292, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume 12292 == #t~mem29; [L1133] havoc #t~mem29; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1236] call write~int(1, ~s.base, 40 + ~s.offset, 4); [L1237] call write~int(4096, ~s.base, 52 + ~s.offset, 4); [L1238] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1238] call #t~mem63 := read~int(#t~mem62.base, 64 + #t~mem62.offset, 4); [L1238] call write~int(1 + #t~mem63, #t~mem62.base, 64 + #t~mem62.offset, 4); [L1238] havoc #t~mem63; [L1238] havoc #t~mem62.base, #t~mem62.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1243] call write~int(0, ~s.base, 36 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1244-L1248] assume 0 != (~cb~0.base + ~cb~0.offset) % 4294967296; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] call #t~mem64 := read~int(~s.base, ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem64=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249-L1254] assume !(768 != ~bitwiseAnd(#t~mem64, 65280)); [L1249] havoc #t~mem64; [L1255] call write~int(4096, ~s.base, 4 + ~s.offset, 4); [L1256] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, 60 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem65.base=2, #t~mem65.offset=-1, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1256-L1273] assume !(0 == (#t~mem65.base + #t~mem65.offset) % 4294967296); [L1256] havoc #t~mem65.base, #t~mem65.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1274-L1279] assume !(0 == ~tmp___4~0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1280-L1285] assume !(0 == ~tmp___5~0); [L1286] call write~int(4368, ~s.base, 52 + ~s.offset, 4); [L1287] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1287] call #t~mem68 := read~int(#t~mem67.base, 60 + #t~mem67.offset, 4); [L1287] call write~int(1 + #t~mem68, #t~mem67.base, 60 + #t~mem67.offset, 4); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67.base, #t~mem67.offset; [L1288] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume 4368 == #t~mem34; [L1148] havoc #t~mem34; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1292] call write~int(0, ~s.base, 48 + ~s.offset, 4); [L1293] assume -2147483648 <= #t~nondet69 && #t~nondet69 <= 2147483647; [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1294-L1298] assume 0 == ~blastFlag~0; [L1295] ~blastFlag~0 := 1; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1299-L1303] assume !(~ret~0 <= 0); [L1304] call write~int(4384, ~s.base, 52 + ~s.offset, 4); [L1305] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1306] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, 20 + ~s.offset, 4); [L1306] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, 16 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem70.base=0, #t~mem70.offset=1, #t~mem71.base=0, #t~mem71.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1306-L1310] assume (#t~mem70.base + #t~mem70.offset) % 4294967296 != (#t~mem71.base + #t~mem71.offset) % 4294967296; [L1306] havoc #t~mem71.base, #t~mem71.offset; [L1306] havoc #t~mem70.base, #t~mem70.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume !(4368 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151-L1595] assume !(4369 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154-L1594] assume 4384 == #t~mem36; [L1154] havoc #t~mem36; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1314] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1315-L1323] assume 1 == ~blastFlag~0; [L1316] ~blastFlag~0 := 2; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1324-L1328] assume !(~ret~0 <= 0); [L1329] call #t~mem73 := read~int(~s.base, 92 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem73=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1329-L1333] assume !(0 != #t~mem73); [L1329] havoc #t~mem73; [L1332] call write~int(4400, ~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1334] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume !(4368 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151-L1595] assume !(4369 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154-L1594] assume !(4384 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem37=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157-L1593] assume !(4385 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem38=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160-L1592] assume 4400 == #t~mem38; [L1160] havoc #t~mem38; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1338] call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, 836 + #t~mem74.offset, 4); [L1338] call #t~mem76 := read~int(#t~mem75.base, 12 + #t~mem75.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem74.base=20495, #t~mem74.offset=0, #t~mem75.base=20511, #t~mem75.offset=0, #t~mem76=20529, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338-L1352] assume !(0 != ~bitwiseAnd(#t~mem76, 256) % 4294967296); [L1338] havoc #t~mem74.base, #t~mem74.offset; [L1338] havoc #t~mem75.base, #t~mem75.offset; [L1338] havoc #t~mem76; [L1341] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1342-L1346] assume 2 == ~blastFlag~0; [L1343] ~blastFlag~0 := 3; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1347-L1351] assume !(~ret~0 <= 0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1353] call write~int(4416, ~s.base, 52 + ~s.offset, 4); [L1354] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume !(4368 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151-L1595] assume !(4369 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154-L1594] assume !(4384 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem37=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157-L1593] assume !(4385 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem38=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160-L1592] assume !(4400 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem39=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163-L1591] assume !(4401 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem40=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166-L1590] assume 4416 == #t~mem40; [L1166] havoc #t~mem40; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1358] assume -2147483648 <= #t~nondet78 && #t~nondet78 <= 2147483647; [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1359-L1363] assume 3 == ~blastFlag~0; [L1360] ~blastFlag~0 := 4; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1364-L1368] assume !(~ret~0 <= 0); [L1369] call write~int(4432, ~s.base, 52 + ~s.offset, 4); [L1370] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1371-L1376] assume !(0 == ~tmp___6~0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume !(4368 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151-L1595] assume !(4369 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154-L1594] assume !(4384 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem37=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157-L1593] assume !(4385 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem38=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160-L1592] assume !(4400 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem39=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163-L1591] assume !(4401 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem40=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166-L1590] assume !(4416 == #t~mem40); [L1166] havoc #t~mem40; [L1169] call #t~mem41 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem41=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1169-L1589] assume !(4417 == #t~mem41); [L1169] havoc #t~mem41; [L1172] call #t~mem42 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem42=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1172-L1588] assume 4432 == #t~mem42; [L1172] havoc #t~mem42; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1380] assume -2147483648 <= #t~nondet79 && #t~nondet79 <= 2147483647; [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1381-L1385] assume 4 == ~blastFlag~0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1643] assert false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=20503, #NULL.offset=20527, old(#NULL.base)=20503, old(#NULL.offset)=20527, old(~#SSLv3_client_data~0.base)=20490, old(~#SSLv3_client_data~0.offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=20486, ~init~0=20533] [?] #NULL.base, #NULL.offset := 0, 0; [?] #valid := #valid[0 := 0]; [L1042] ~init~0 := 1; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100); [L1043] call write~init~int(0, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 4 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 8 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 12 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 16 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 20 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 24 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 28 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 32 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 36 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 40 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 44 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 48 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 52 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 56 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 60 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 64 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 68 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 72 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 76 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 80 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 84 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 88 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 92 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 96 + ~#SSLv3_client_data~0.offset, 4); VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20503, old(#NULL.offset)=20527, old(~#SSLv3_client_data~0.base)=20490, old(~#SSLv3_client_data~0.offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] ensures true; VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20503, old(#NULL.offset)=20527, old(~#SSLv3_client_data~0.base)=20490, old(~#SSLv3_client_data~0.offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, 84 + ~s~0.offset, 4); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, 204 + ~s~0.offset, 4); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, 176 + ~s~0.offset, 4); [L1072] call write~int(12292, ~s~0.base, 52 + ~s~0.offset, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] call write~int(#t~nondet7, ~s~0.base, ~s~0.offset, 4); [L1073] havoc #t~nondet7; VAL [#NULL.base=0, #NULL.offset=0, #t~malloc3.base=20498, #t~malloc3.offset=0, #t~malloc4.base=20495, #t~malloc4.offset=0, #t~malloc5.base=20536, #t~malloc5.offset=0, #t~malloc6.base=20483, #t~malloc6.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1, ~s~0.base=20498, ~s~0.offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1079-L1645] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] havoc ~buf~0.base, ~buf~0.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset; [L1089] havoc #t~nondet9.base, #t~nondet9.offset; [L1090] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] assume -2147483648 <= #t~nondet15 && #t~nondet15 <= 2147483647; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] assume -2147483648 <= #t~nondet16 && #t~nondet16 <= 2147483647; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] assume -2147483648 <= #t~nondet17 && #t~nondet17 <= 2147483647; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] assume -2147483648 <= #t~nondet18 && #t~nondet18 <= 2147483647; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0; [L1103] assume -2147483648 <= #t~nondet19 && #t~nondet19 <= 2147483647; [L1103] call write~int(#t~nondet19, ~s.base, 92 + ~s.offset, 4); [L1103] havoc #t~nondet19; [L1104] call write~int(12292, ~s.base, 52 + ~s.offset, 4); [L1105] assume -2147483648 <= #t~nondet20 && #t~nondet20 <= 2147483647; [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0.base, ~cb~0.offset := 0, 0; [L1107] ~ret~0 := -1; [L1108] ~skip~0 := 0; [L1109] call write~int(0, ~tmp___0~1.base, ~tmp___0~1.offset, 4); [L1110] call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem21.base=1, #t~mem21.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=0, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1110-L1118] assume 0 != (#t~mem21.base + #t~mem21.offset) % 4294967296; [L1110] havoc #t~mem21.base, #t~mem21.offset; [L1111] call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset; [L1111] havoc #t~mem22.base, #t~mem22.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1119] call #t~mem27 := read~int(~s.base, 28 + ~s.offset, 4); [L1119] call write~int(1 + #t~mem27, ~s.base, 28 + ~s.offset, 4); [L1119] havoc #t~mem27; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1120-L1128] assume !(0 != ~bitwiseAnd(~tmp___1~0, 12288)); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=12292, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume 12292 == #t~mem29; [L1133] havoc #t~mem29; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1236] call write~int(1, ~s.base, 40 + ~s.offset, 4); [L1237] call write~int(4096, ~s.base, 52 + ~s.offset, 4); [L1238] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1238] call #t~mem63 := read~int(#t~mem62.base, 64 + #t~mem62.offset, 4); [L1238] call write~int(1 + #t~mem63, #t~mem62.base, 64 + #t~mem62.offset, 4); [L1238] havoc #t~mem63; [L1238] havoc #t~mem62.base, #t~mem62.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1243] call write~int(0, ~s.base, 36 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1244-L1248] assume 0 != (~cb~0.base + ~cb~0.offset) % 4294967296; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] call #t~mem64 := read~int(~s.base, ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem64=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249-L1254] assume !(768 != ~bitwiseAnd(#t~mem64, 65280)); [L1249] havoc #t~mem64; [L1255] call write~int(4096, ~s.base, 4 + ~s.offset, 4); [L1256] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, 60 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem65.base=2, #t~mem65.offset=-1, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1256-L1273] assume !(0 == (#t~mem65.base + #t~mem65.offset) % 4294967296); [L1256] havoc #t~mem65.base, #t~mem65.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1274-L1279] assume !(0 == ~tmp___4~0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1280-L1285] assume !(0 == ~tmp___5~0); [L1286] call write~int(4368, ~s.base, 52 + ~s.offset, 4); [L1287] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1287] call #t~mem68 := read~int(#t~mem67.base, 60 + #t~mem67.offset, 4); [L1287] call write~int(1 + #t~mem68, #t~mem67.base, 60 + #t~mem67.offset, 4); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67.base, #t~mem67.offset; [L1288] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4368, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume 4368 == #t~mem34; [L1148] havoc #t~mem34; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1292] call write~int(0, ~s.base, 48 + ~s.offset, 4); [L1293] assume -2147483648 <= #t~nondet69 && #t~nondet69 <= 2147483647; [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1294-L1298] assume 0 == ~blastFlag~0; [L1295] ~blastFlag~0 := 1; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1299-L1303] assume !(~ret~0 <= 0); [L1304] call write~int(4384, ~s.base, 52 + ~s.offset, 4); [L1305] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1306] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, 20 + ~s.offset, 4); [L1306] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, 16 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem70.base=0, #t~mem70.offset=1, #t~mem71.base=0, #t~mem71.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1306-L1310] assume (#t~mem70.base + #t~mem70.offset) % 4294967296 != (#t~mem71.base + #t~mem71.offset) % 4294967296; [L1306] havoc #t~mem71.base, #t~mem71.offset; [L1306] havoc #t~mem70.base, #t~mem70.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume !(4368 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151-L1595] assume !(4369 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4384, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154-L1594] assume 4384 == #t~mem36; [L1154] havoc #t~mem36; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1314] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1315-L1323] assume 1 == ~blastFlag~0; [L1316] ~blastFlag~0 := 2; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1324-L1328] assume !(~ret~0 <= 0); [L1329] call #t~mem73 := read~int(~s.base, 92 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem73=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1329-L1333] assume !(0 != #t~mem73); [L1329] havoc #t~mem73; [L1332] call write~int(4400, ~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1334] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume !(4368 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151-L1595] assume !(4369 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154-L1594] assume !(4384 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem37=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157-L1593] assume !(4385 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem38=4400, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160-L1592] assume 4400 == #t~mem38; [L1160] havoc #t~mem38; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1338] call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, 836 + #t~mem74.offset, 4); [L1338] call #t~mem76 := read~int(#t~mem75.base, 12 + #t~mem75.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem74.base=20495, #t~mem74.offset=0, #t~mem75.base=20511, #t~mem75.offset=0, #t~mem76=20529, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338-L1352] assume !(0 != ~bitwiseAnd(#t~mem76, 256) % 4294967296); [L1338] havoc #t~mem74.base, #t~mem74.offset; [L1338] havoc #t~mem75.base, #t~mem75.offset; [L1338] havoc #t~mem76; [L1341] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1342-L1346] assume 2 == ~blastFlag~0; [L1343] ~blastFlag~0 := 3; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1347-L1351] assume !(~ret~0 <= 0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1353] call write~int(4416, ~s.base, 52 + ~s.offset, 4); [L1354] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume !(4368 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151-L1595] assume !(4369 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154-L1594] assume !(4384 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem37=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157-L1593] assume !(4385 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem38=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160-L1592] assume !(4400 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem39=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163-L1591] assume !(4401 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem40=4416, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166-L1590] assume 4416 == #t~mem40; [L1166] havoc #t~mem40; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1358] assume -2147483648 <= #t~nondet78 && #t~nondet78 <= 2147483647; [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1359-L1363] assume 3 == ~blastFlag~0; [L1360] ~blastFlag~0 := 4; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1364-L1368] assume !(~ret~0 <= 0); [L1369] call write~int(4432, ~s.base, 52 + ~s.offset, 4); [L1370] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1371-L1376] assume !(0 == ~tmp___6~0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1602] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem127.base=20495, #t~mem127.offset=0, #t~mem128=20505, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602-L1630] assume !(0 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133-L1601] assume !(12292 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136-L1600] assume !(16384 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139-L1599] assume !(4096 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142-L1598] assume !(20480 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145-L1597] assume !(4099 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148-L1596] assume !(4368 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151-L1595] assume !(4369 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154-L1594] assume !(4384 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem37=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157-L1593] assume !(4385 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem38=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160-L1592] assume !(4400 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem39=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163-L1591] assume !(4401 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem40=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166-L1590] assume !(4416 == #t~mem40); [L1166] havoc #t~mem40; [L1169] call #t~mem41 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem41=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1169-L1589] assume !(4417 == #t~mem41); [L1169] havoc #t~mem41; [L1172] call #t~mem42 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem42=4432, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1172-L1588] assume 4432 == #t~mem42; [L1172] havoc #t~mem42; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1380] assume -2147483648 <= #t~nondet79 && #t~nondet79 <= 2147483647; [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1381-L1385] assume 4 == ~blastFlag~0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1643] assert false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20498, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20503, #NULL!offset=20527, old(#NULL!base)=20503, old(#NULL!offset)=20527, old(~#SSLv3_client_data~0!base)=20490, old(~#SSLv3_client_data~0!offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=20486, ~init~0=20533] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1042] ~init~0 := 1; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1043] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20503, old(#NULL!offset)=20527, old(~#SSLv3_client_data~0!base)=20490, old(~#SSLv3_client_data~0!offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: 176 + ~s~0!offset }, 4); [L1072] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] FCALL call write~int(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1073] havoc #t~nondet7; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20498, #t~malloc3!offset=0, #t~malloc4!base=20495, #t~malloc4!offset=0, #t~malloc5!base=20536, #t~malloc5!offset=0, #t~malloc6!base=20483, #t~malloc6!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20498, ~s~0!offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] assume -2147483648 <= #t~nondet15 && #t~nondet15 <= 2147483647; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] assume -2147483648 <= #t~nondet16 && #t~nondet16 <= 2147483647; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] assume -2147483648 <= #t~nondet17 && #t~nondet17 <= 2147483647; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] assume -2147483648 <= #t~nondet18 && #t~nondet18 <= 2147483647; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0; [L1103] assume -2147483648 <= #t~nondet19 && #t~nondet19 <= 2147483647; [L1103] FCALL call write~int(#t~nondet19, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1103] havoc #t~nondet19; [L1104] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1105] assume -2147483648 <= #t~nondet20 && #t~nondet20 <= 2147483647; [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0, offset: 0 }; [L1107] ~ret~0 := -1; [L1108] ~skip~0 := 0; [L1109] FCALL call write~int(0, ~tmp___0~1, 4); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem21!base=1, #t~mem21!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1110] COND TRUE 0 != (#t~mem21!base + #t~mem21!offset) % 4294967296 [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1119] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] FCALL call write~int(1 + #t~mem27, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] havoc #t~mem27; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1120-L1128] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=12292, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND TRUE 12292 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1236] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1237] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1238] FCALL call #t~mem63 := read~int({ base: #t~mem62!base, offset: 64 + #t~mem62!offset }, 4); [L1238] FCALL call write~int(1 + #t~mem63, { base: #t~mem62!base, offset: 64 + #t~mem62!offset }, 4); [L1238] havoc #t~mem63; [L1238] havoc #t~mem62; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1243] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1244] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] FCALL call #t~mem64 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem64=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] COND FALSE !(768 != ~bitwiseAnd(#t~mem64, 65280)) [L1249] havoc #t~mem64; [L1255] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem65!base=2, #t~mem65!offset=-1, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1256] COND FALSE !(0 == (#t~mem65!base + #t~mem65!offset) % 4294967296) [L1256] havoc #t~mem65; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1274] COND FALSE !(0 == ~tmp___4~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1280] COND FALSE !(0 == ~tmp___5~0) [L1286] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1287] FCALL call #t~mem68 := read~int({ base: #t~mem67!base, offset: 60 + #t~mem67!offset }, 4); [L1287] FCALL call write~int(1 + #t~mem68, { base: #t~mem67!base, offset: 60 + #t~mem67!offset }, 4); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND TRUE 4368 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1292] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1293] assume -2147483648 <= #t~nondet69 && #t~nondet69 <= 2147483647; [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1294] COND TRUE 0 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1299] COND FALSE !(~ret~0 <= 0) [L1304] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1305] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem70!base=0, #t~mem70!offset=1, #t~mem71!base=0, #t~mem71!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1306] COND TRUE (#t~mem70!base + #t~mem70!offset) % 4294967296 != (#t~mem71!base + #t~mem71!offset) % 4294967296 [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND TRUE 4384 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1314] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1315] COND TRUE 1 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1324] COND FALSE !(~ret~0 <= 0) [L1329] FCALL call #t~mem73 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem73=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1329-L1333] COND FALSE !(0 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1334] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND TRUE 4400 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: 836 + #t~mem74!offset }, 4); [L1338] FCALL call #t~mem76 := read~int({ base: #t~mem75!base, offset: 12 + #t~mem75!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem74!base=20495, #t~mem74!offset=0, #t~mem75!base=20511, #t~mem75!offset=0, #t~mem76=20529, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338-L1352] COND FALSE !(0 != ~bitwiseAnd(#t~mem76, 256) % 4294967296) [L1338] havoc #t~mem74; [L1338] havoc #t~mem75; [L1338] havoc #t~mem76; [L1341] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1342] COND TRUE 2 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1347] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1353] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1354] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem39=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem40=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166] COND TRUE 4416 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1358] assume -2147483648 <= #t~nondet78 && #t~nondet78 <= 2147483647; [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1359] COND TRUE 3 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1364] COND FALSE !(~ret~0 <= 0) [L1369] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1370] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1371] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem39=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem40=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem41=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem42=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1172] COND TRUE 4432 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1380] assume -2147483648 <= #t~nondet79 && #t~nondet79 <= 2147483647; [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1381] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1643] assert false; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20503, #NULL!offset=20527, old(#NULL!base)=20503, old(#NULL!offset)=20527, old(~#SSLv3_client_data~0!base)=20490, old(~#SSLv3_client_data~0!offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=20486, ~init~0=20533] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1042] ~init~0 := 1; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1043] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20503, old(#NULL!offset)=20527, old(~#SSLv3_client_data~0!base)=20490, old(~#SSLv3_client_data~0!offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: 176 + ~s~0!offset }, 4); [L1072] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] FCALL call write~int(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1073] havoc #t~nondet7; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20498, #t~malloc3!offset=0, #t~malloc4!base=20495, #t~malloc4!offset=0, #t~malloc5!base=20536, #t~malloc5!offset=0, #t~malloc6!base=20483, #t~malloc6!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20498, ~s~0!offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] assume -2147483648 <= #t~nondet15 && #t~nondet15 <= 2147483647; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] assume -2147483648 <= #t~nondet16 && #t~nondet16 <= 2147483647; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] assume -2147483648 <= #t~nondet17 && #t~nondet17 <= 2147483647; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] assume -2147483648 <= #t~nondet18 && #t~nondet18 <= 2147483647; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0; [L1103] assume -2147483648 <= #t~nondet19 && #t~nondet19 <= 2147483647; [L1103] FCALL call write~int(#t~nondet19, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1103] havoc #t~nondet19; [L1104] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1105] assume -2147483648 <= #t~nondet20 && #t~nondet20 <= 2147483647; [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0, offset: 0 }; [L1107] ~ret~0 := -1; [L1108] ~skip~0 := 0; [L1109] FCALL call write~int(0, ~tmp___0~1, 4); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem21!base=1, #t~mem21!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1110] COND TRUE 0 != (#t~mem21!base + #t~mem21!offset) % 4294967296 [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1119] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] FCALL call write~int(1 + #t~mem27, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] havoc #t~mem27; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1120-L1128] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=12292, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND TRUE 12292 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1236] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1237] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1238] FCALL call #t~mem63 := read~int({ base: #t~mem62!base, offset: 64 + #t~mem62!offset }, 4); [L1238] FCALL call write~int(1 + #t~mem63, { base: #t~mem62!base, offset: 64 + #t~mem62!offset }, 4); [L1238] havoc #t~mem63; [L1238] havoc #t~mem62; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1243] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1244] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] FCALL call #t~mem64 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem64=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] COND FALSE !(768 != ~bitwiseAnd(#t~mem64, 65280)) [L1249] havoc #t~mem64; [L1255] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem65!base=2, #t~mem65!offset=-1, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1256] COND FALSE !(0 == (#t~mem65!base + #t~mem65!offset) % 4294967296) [L1256] havoc #t~mem65; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1274] COND FALSE !(0 == ~tmp___4~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1280] COND FALSE !(0 == ~tmp___5~0) [L1286] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1287] FCALL call #t~mem68 := read~int({ base: #t~mem67!base, offset: 60 + #t~mem67!offset }, 4); [L1287] FCALL call write~int(1 + #t~mem68, { base: #t~mem67!base, offset: 60 + #t~mem67!offset }, 4); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND TRUE 4368 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1292] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1293] assume -2147483648 <= #t~nondet69 && #t~nondet69 <= 2147483647; [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1294] COND TRUE 0 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1299] COND FALSE !(~ret~0 <= 0) [L1304] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1305] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem70!base=0, #t~mem70!offset=1, #t~mem71!base=0, #t~mem71!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1306] COND TRUE (#t~mem70!base + #t~mem70!offset) % 4294967296 != (#t~mem71!base + #t~mem71!offset) % 4294967296 [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND TRUE 4384 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1314] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1315] COND TRUE 1 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1324] COND FALSE !(~ret~0 <= 0) [L1329] FCALL call #t~mem73 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem73=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1329-L1333] COND FALSE !(0 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1334] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND TRUE 4400 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: 836 + #t~mem74!offset }, 4); [L1338] FCALL call #t~mem76 := read~int({ base: #t~mem75!base, offset: 12 + #t~mem75!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem74!base=20495, #t~mem74!offset=0, #t~mem75!base=20511, #t~mem75!offset=0, #t~mem76=20529, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338-L1352] COND FALSE !(0 != ~bitwiseAnd(#t~mem76, 256) % 4294967296) [L1338] havoc #t~mem74; [L1338] havoc #t~mem75; [L1338] havoc #t~mem76; [L1341] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1342] COND TRUE 2 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1347] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1353] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1354] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem39=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem40=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166] COND TRUE 4416 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1358] assume -2147483648 <= #t~nondet78 && #t~nondet78 <= 2147483647; [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1359] COND TRUE 3 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1364] COND FALSE !(~ret~0 <= 0) [L1369] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1370] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1371] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem39=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem40=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem41=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem42=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1172] COND TRUE 4432 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1380] assume -2147483648 <= #t~nondet79 && #t~nondet79 <= 2147483647; [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1381] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1643] assert false; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20503, #NULL!offset=20527, old(#NULL!base)=20503, old(#NULL!offset)=20527, old(~#SSLv3_client_data~0!base)=20490, old(~#SSLv3_client_data~0!offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=20486, ~init~0=20533] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1042] ~init~0 := 1; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1043] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20503, old(#NULL!offset)=20527, old(~#SSLv3_client_data~0!base)=20490, old(~#SSLv3_client_data~0!offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: 176 + ~s~0!offset }, 4); [L1072] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] FCALL call write~int(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1073] havoc #t~nondet7; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20498, #t~malloc3!offset=0, #t~malloc4!base=20495, #t~malloc4!offset=0, #t~malloc5!base=20536, #t~malloc5!offset=0, #t~malloc6!base=20483, #t~malloc6!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20498, ~s~0!offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] assume -2147483648 <= #t~nondet15 && #t~nondet15 <= 2147483647; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] assume -2147483648 <= #t~nondet16 && #t~nondet16 <= 2147483647; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] assume -2147483648 <= #t~nondet17 && #t~nondet17 <= 2147483647; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] assume -2147483648 <= #t~nondet18 && #t~nondet18 <= 2147483647; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0; [L1103] assume -2147483648 <= #t~nondet19 && #t~nondet19 <= 2147483647; [L1103] FCALL call write~int(#t~nondet19, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1103] havoc #t~nondet19; [L1104] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1105] assume -2147483648 <= #t~nondet20 && #t~nondet20 <= 2147483647; [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0, offset: 0 }; [L1107] ~ret~0 := -1; [L1108] ~skip~0 := 0; [L1109] FCALL call write~int(0, ~tmp___0~1, 4); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem21!base=1, #t~mem21!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1110] COND TRUE 0 != (#t~mem21!base + #t~mem21!offset) % 4294967296 [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1119] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] FCALL call write~int(1 + #t~mem27, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] havoc #t~mem27; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1120-L1128] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=12292, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND TRUE 12292 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1236] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1237] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1238] FCALL call #t~mem63 := read~int({ base: #t~mem62!base, offset: 64 + #t~mem62!offset }, 4); [L1238] FCALL call write~int(1 + #t~mem63, { base: #t~mem62!base, offset: 64 + #t~mem62!offset }, 4); [L1238] havoc #t~mem63; [L1238] havoc #t~mem62; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1243] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1244] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] FCALL call #t~mem64 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem64=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] COND FALSE !(768 != ~bitwiseAnd(#t~mem64, 65280)) [L1249] havoc #t~mem64; [L1255] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem65!base=2, #t~mem65!offset=-1, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1256] COND FALSE !(0 == (#t~mem65!base + #t~mem65!offset) % 4294967296) [L1256] havoc #t~mem65; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1274] COND FALSE !(0 == ~tmp___4~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1280] COND FALSE !(0 == ~tmp___5~0) [L1286] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1287] FCALL call #t~mem68 := read~int({ base: #t~mem67!base, offset: 60 + #t~mem67!offset }, 4); [L1287] FCALL call write~int(1 + #t~mem68, { base: #t~mem67!base, offset: 60 + #t~mem67!offset }, 4); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND TRUE 4368 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1292] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1293] assume -2147483648 <= #t~nondet69 && #t~nondet69 <= 2147483647; [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1294] COND TRUE 0 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1299] COND FALSE !(~ret~0 <= 0) [L1304] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1305] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem70!base=0, #t~mem70!offset=1, #t~mem71!base=0, #t~mem71!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1306] COND TRUE (#t~mem70!base + #t~mem70!offset) % 4294967296 != (#t~mem71!base + #t~mem71!offset) % 4294967296 [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND TRUE 4384 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1314] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1315] COND TRUE 1 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1324] COND FALSE !(~ret~0 <= 0) [L1329] FCALL call #t~mem73 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem73=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1329-L1333] COND FALSE !(0 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1334] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND TRUE 4400 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: 836 + #t~mem74!offset }, 4); [L1338] FCALL call #t~mem76 := read~int({ base: #t~mem75!base, offset: 12 + #t~mem75!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem74!base=20495, #t~mem74!offset=0, #t~mem75!base=20511, #t~mem75!offset=0, #t~mem76=20529, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338-L1352] COND FALSE !(0 != ~bitwiseAnd(#t~mem76, 256) % 4294967296) [L1338] havoc #t~mem74; [L1338] havoc #t~mem75; [L1338] havoc #t~mem76; [L1341] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1342] COND TRUE 2 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1347] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1353] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1354] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem39=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem40=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166] COND TRUE 4416 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1358] assume -2147483648 <= #t~nondet78 && #t~nondet78 <= 2147483647; [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1359] COND TRUE 3 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1364] COND FALSE !(~ret~0 <= 0) [L1369] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1370] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1371] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem39=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem40=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem41=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem42=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1172] COND TRUE 4432 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1380] assume -2147483648 <= #t~nondet79 && #t~nondet79 <= 2147483647; [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1381] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1643] assert false; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] ----- [2018-11-22 23:05:05,631 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 20486 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# [2018-11-22 23:05:05,650 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 20490 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20503, #NULL!offset=20527, old(#NULL!base)=20503, old(#NULL!offset)=20527, old(~#SSLv3_client_data~0!base)=20490, old(~#SSLv3_client_data~0!offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=20486, ~init~0=20533] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1042] ~init~0 := 1; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1043] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20503, old(#NULL!offset)=20527, old(~#SSLv3_client_data~0!base)=20490, old(~#SSLv3_client_data~0!offset)=20486, old(~init~0)=20533, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: 176 + ~s~0!offset }, 4); [L1072] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] FCALL call write~int(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1073] havoc #t~nondet7; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20498, #t~malloc3!offset=0, #t~malloc4!base=20495, #t~malloc4!offset=0, #t~malloc5!base=20536, #t~malloc5!offset=0, #t~malloc6!base=20483, #t~malloc6!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20498, ~s~0!offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] assume -2147483648 <= #t~nondet15 && #t~nondet15 <= 2147483647; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] assume -2147483648 <= #t~nondet16 && #t~nondet16 <= 2147483647; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] assume -2147483648 <= #t~nondet17 && #t~nondet17 <= 2147483647; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] assume -2147483648 <= #t~nondet18 && #t~nondet18 <= 2147483647; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0; [L1103] assume -2147483648 <= #t~nondet19 && #t~nondet19 <= 2147483647; [L1103] FCALL call write~int(#t~nondet19, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1103] havoc #t~nondet19; [L1104] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1105] assume -2147483648 <= #t~nondet20 && #t~nondet20 <= 2147483647; [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0, offset: 0 }; [L1107] ~ret~0 := -1; [L1108] ~skip~0 := 0; [L1109] FCALL call write~int(0, ~tmp___0~1, 4); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem21!base=1, #t~mem21!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1110] COND TRUE 0 != (#t~mem21!base + #t~mem21!offset) % 4294967296 [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1119] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] FCALL call write~int(1 + #t~mem27, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] havoc #t~mem27; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1120-L1128] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=12292, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND TRUE 12292 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1236] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1237] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1238] FCALL call #t~mem63 := read~int({ base: #t~mem62!base, offset: 64 + #t~mem62!offset }, 4); [L1238] FCALL call write~int(1 + #t~mem63, { base: #t~mem62!base, offset: 64 + #t~mem62!offset }, 4); [L1238] havoc #t~mem63; [L1238] havoc #t~mem62; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1243] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1244] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] FCALL call #t~mem64 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem64=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1249] COND FALSE !(768 != ~bitwiseAnd(#t~mem64, 65280)) [L1249] havoc #t~mem64; [L1255] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem65!base=2, #t~mem65!offset=-1, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1256] COND FALSE !(0 == (#t~mem65!base + #t~mem65!offset) % 4294967296) [L1256] havoc #t~mem65; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1274] COND FALSE !(0 == ~tmp___4~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1280] COND FALSE !(0 == ~tmp___5~0) [L1286] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1287] FCALL call #t~mem68 := read~int({ base: #t~mem67!base, offset: 60 + #t~mem67!offset }, 4); [L1287] FCALL call write~int(1 + #t~mem68, { base: #t~mem67!base, offset: 60 + #t~mem67!offset }, 4); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4368, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND TRUE 4368 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1292] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1293] assume -2147483648 <= #t~nondet69 && #t~nondet69 <= 2147483647; [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1294] COND TRUE 0 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1299] COND FALSE !(~ret~0 <= 0) [L1304] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1305] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem70!base=0, #t~mem70!offset=1, #t~mem71!base=0, #t~mem71!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1306] COND TRUE (#t~mem70!base + #t~mem70!offset) % 4294967296 != (#t~mem71!base + #t~mem71!offset) % 4294967296 [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4384, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND TRUE 4384 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1314] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1315] COND TRUE 1 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1324] COND FALSE !(~ret~0 <= 0) [L1329] FCALL call #t~mem73 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem73=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1329-L1333] COND FALSE !(0 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1334] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4400, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND TRUE 4400 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: 836 + #t~mem74!offset }, 4); [L1338] FCALL call #t~mem76 := read~int({ base: #t~mem75!base, offset: 12 + #t~mem75!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem74!base=20495, #t~mem74!offset=0, #t~mem75!base=20511, #t~mem75!offset=0, #t~mem76=20529, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1338-L1352] COND FALSE !(0 != ~bitwiseAnd(#t~mem76, 256) % 4294967296) [L1338] havoc #t~mem74; [L1338] havoc #t~mem75; [L1338] havoc #t~mem76; [L1341] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1342] COND TRUE 2 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1347] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1353] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1354] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem39=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem40=4416, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166] COND TRUE 4416 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1358] assume -2147483648 <= #t~nondet78 && #t~nondet78 <= 2147483647; [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1359] COND TRUE 3 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1364] COND FALSE !(~ret~0 <= 0) [L1369] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1370] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1371] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1602] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem127!base=20495, #t~mem127!offset=0, #t~mem128=20505, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1602] COND FALSE !(0 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1631] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem39=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem40=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem41=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem42=4432, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1172] COND TRUE 4432 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1380] assume -2147483648 <= #t~nondet79 && #t~nondet79 <= 2147483647; [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1381] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1643] assert false; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20498, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___3~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp___7~0=0, ~tmp___8~0=0, ~tmp___9~0=0, ~tmp~2=0] [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=20533, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={20492:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={20498:0}, SSLv3_client_data={20492:0}] [L1080] BUF_MEM *buf ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 = __VERIFIER_nondet_int() ; [L1093] int tmp___4 = __VERIFIER_nondet_int() ; [L1094] int tmp___5 = __VERIFIER_nondet_int() ; [L1095] int tmp___6 = __VERIFIER_nondet_int() ; [L1096] int tmp___7 = __VERIFIER_nondet_int() ; [L1097] int tmp___8 = __VERIFIER_nondet_int() ; [L1098] long tmp___9 = __VERIFIER_nondet_long() ; [L1099] int blastFlag ; [L1102] blastFlag = 0 [L1103] s->hit=__VERIFIER_nondet_int () [L1104] s->state = 12292 [L1105] tmp = __VERIFIER_nondet_int() [L1106] cb = (void (*)())((void *)0) [L1107] ret = -1 [L1108] skip = 0 [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->info_callback={1:0}, skip=0, SSLv3_client_data={20492:0}, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=12292, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] EXPR s->version VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->version=0, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->init_buf={2:-1}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1274] COND FALSE !(! tmp___4) VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1280] COND FALSE !(! tmp___5) [L1286] s->state = 4368 [L1287] EXPR s->ctx [L1287] EXPR (s->ctx)->stats.sess_connect [L1287] (s->ctx)->stats.sess_connect += 1 [L1288] s->init_num = 0 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND TRUE s->state == 4368 [L1292] s->shutdown = 0 [L1293] ret = __VERIFIER_nondet_int() [L1294] COND TRUE blastFlag == 0 [L1295] blastFlag = 1 VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1299] COND FALSE !(ret <= 0) [L1304] s->state = 4384 [L1305] s->init_num = 0 [L1306] EXPR s->bbio [L1306] EXPR s->wbio VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->bbio={0:1}, s->wbio={0:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1306] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND TRUE s->state == 4384 [L1314] ret = __VERIFIER_nondet_int() [L1315] COND TRUE blastFlag == 1 [L1316] blastFlag = 2 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1324] COND FALSE !(ret <= 0) [L1329] s->hit VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->hit=0, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1329] COND FALSE !(s->hit) [L1332] s->state = 4400 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1334] s->init_num = 0 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND TRUE s->state == 4400 [L1338] EXPR s->s3 [L1338] EXPR (s->s3)->tmp.new_cipher [L1338] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={1:0}, ((s->s3)->tmp.new_cipher)->algorithms=20529, (s->s3)->tmp.new_cipher={20511:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1338] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1341] ret = __VERIFIER_nondet_int() [L1342] COND TRUE blastFlag == 2 [L1343] blastFlag = 3 VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1347] COND FALSE !(ret <= 0) VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1353] s->state = 4416 [L1354] s->init_num = 0 VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND TRUE s->state == 4416 [L1358] ret = __VERIFIER_nondet_int() [L1359] COND TRUE blastFlag == 3 [L1360] blastFlag = 4 VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1364] COND FALSE !(ret <= 0) [L1369] s->state = 4432 [L1370] s->init_num = 0 VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1371] COND FALSE !(! tmp___6) VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1172] COND TRUE s->state == 4432 [L1380] ret = __VERIFIER_nondet_int() [L1381] COND TRUE blastFlag == 4 VAL [={1:0}, blastFlag=4, init=1, ret=0, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1643] __VERIFIER_error() VAL [={1:0}, blastFlag=4, init=1, ret=0, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] ----- [2018-11-22 23:05:06,343 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 22.11 11:05:06 BoogieIcfgContainer [2018-11-22 23:05:06,343 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2018-11-22 23:05:06,344 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2018-11-22 23:05:06,344 INFO L271 PluginConnector]: Initializing Witness Printer... [2018-11-22 23:05:06,344 INFO L276 PluginConnector]: Witness Printer initialized [2018-11-22 23:05:06,345 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.11 11:04:55" (3/4) ... [2018-11-22 23:05:06,349 INFO L147 WitnessPrinter]: No result that supports witness generation found [2018-11-22 23:05:06,349 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-22 23:05:06,350 INFO L168 Benchmark]: Toolchain (without parser) took 12265.01 ms. Allocated memory was 1.0 GB in the beginning and 1.3 GB in the end (delta: 256.4 MB). Free memory was 956.6 MB in the beginning and 971.7 MB in the end (delta: -15.1 MB). Peak memory consumption was 241.3 MB. Max. memory is 11.5 GB. [2018-11-22 23:05:06,351 INFO L168 Benchmark]: CDTParser took 0.11 ms. Allocated memory is still 1.0 GB. Free memory is still 985.6 MB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-22 23:05:06,351 INFO L168 Benchmark]: CACSL2BoogieTranslator took 499.49 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 144.2 MB). Free memory was 956.6 MB in the beginning and 1.1 GB in the end (delta: -171.7 MB). Peak memory consumption was 43.8 MB. Max. memory is 11.5 GB. [2018-11-22 23:05:06,352 INFO L168 Benchmark]: Boogie Procedure Inliner took 32.71 ms. Allocated memory is still 1.2 GB. Free memory is still 1.1 GB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-22 23:05:06,352 INFO L168 Benchmark]: Boogie Preprocessor took 63.96 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 8.1 MB). Peak memory consumption was 8.1 MB. Max. memory is 11.5 GB. [2018-11-22 23:05:06,353 INFO L168 Benchmark]: RCFGBuilder took 800.61 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.0 GB in the end (delta: 87.0 MB). Peak memory consumption was 87.0 MB. Max. memory is 11.5 GB. [2018-11-22 23:05:06,359 INFO L168 Benchmark]: TraceAbstraction took 10859.46 ms. Allocated memory was 1.2 GB in the beginning and 1.3 GB in the end (delta: 112.2 MB). Free memory was 1.0 GB in the beginning and 971.7 MB in the end (delta: 61.6 MB). Peak memory consumption was 173.8 MB. Max. memory is 11.5 GB. [2018-11-22 23:05:06,360 INFO L168 Benchmark]: Witness Printer took 5.01 ms. Allocated memory is still 1.3 GB. Free memory is still 971.7 MB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-22 23:05:06,363 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.11 ms. Allocated memory is still 1.0 GB. Free memory is still 985.6 MB. There was no memory consumed. Max. memory is 11.5 GB. * CACSL2BoogieTranslator took 499.49 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 144.2 MB). Free memory was 956.6 MB in the beginning and 1.1 GB in the end (delta: -171.7 MB). Peak memory consumption was 43.8 MB. Max. memory is 11.5 GB. * Boogie Procedure Inliner took 32.71 ms. Allocated memory is still 1.2 GB. Free memory is still 1.1 GB. There was no memory consumed. Max. memory is 11.5 GB. * Boogie Preprocessor took 63.96 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 8.1 MB). Peak memory consumption was 8.1 MB. Max. memory is 11.5 GB. * RCFGBuilder took 800.61 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.0 GB in the end (delta: 87.0 MB). Peak memory consumption was 87.0 MB. Max. memory is 11.5 GB. * TraceAbstraction took 10859.46 ms. Allocated memory was 1.2 GB in the beginning and 1.3 GB in the end (delta: 112.2 MB). Free memory was 1.0 GB in the beginning and 971.7 MB in the end (delta: 61.6 MB). Peak memory consumption was 173.8 MB. Max. memory is 11.5 GB. * Witness Printer took 5.01 ms. Allocated memory is still 1.3 GB. Free memory is still 971.7 MB. There was no memory consumed. Max. memory is 11.5 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 20486 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 20490 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - UnprovableResult [Line: 1643]: Unable to prove that call of __VERIFIER_error() unreachable Unable to prove that call of __VERIFIER_error() unreachable Reason: overapproximation of bitwiseAnd at line 1338. Possible FailurePath: [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=20533, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={20492:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={20498:0}, SSLv3_client_data={20492:0}] [L1080] BUF_MEM *buf ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 = __VERIFIER_nondet_int() ; [L1093] int tmp___4 = __VERIFIER_nondet_int() ; [L1094] int tmp___5 = __VERIFIER_nondet_int() ; [L1095] int tmp___6 = __VERIFIER_nondet_int() ; [L1096] int tmp___7 = __VERIFIER_nondet_int() ; [L1097] int tmp___8 = __VERIFIER_nondet_int() ; [L1098] long tmp___9 = __VERIFIER_nondet_long() ; [L1099] int blastFlag ; [L1102] blastFlag = 0 [L1103] s->hit=__VERIFIER_nondet_int () [L1104] s->state = 12292 [L1105] tmp = __VERIFIER_nondet_int() [L1106] cb = (void (*)())((void *)0) [L1107] ret = -1 [L1108] skip = 0 [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->info_callback={1:0}, skip=0, SSLv3_client_data={20492:0}, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=12292, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] EXPR s->version VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->version=0, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->init_buf={2:-1}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1274] COND FALSE !(! tmp___4) VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1280] COND FALSE !(! tmp___5) [L1286] s->state = 4368 [L1287] EXPR s->ctx [L1287] EXPR (s->ctx)->stats.sess_connect [L1287] (s->ctx)->stats.sess_connect += 1 [L1288] s->init_num = 0 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=12292, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=0, init=1, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND TRUE s->state == 4368 [L1292] s->shutdown = 0 [L1293] ret = __VERIFIER_nondet_int() [L1294] COND TRUE blastFlag == 0 [L1295] blastFlag = 1 VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1299] COND FALSE !(ret <= 0) [L1304] s->state = 4384 [L1305] s->init_num = 0 [L1306] EXPR s->bbio [L1306] EXPR s->wbio VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->bbio={0:1}, s->wbio={0:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1306] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4368, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={1:0}, blastFlag=1, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND TRUE s->state == 4384 [L1314] ret = __VERIFIER_nondet_int() [L1315] COND TRUE blastFlag == 1 [L1316] blastFlag = 2 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1324] COND FALSE !(ret <= 0) [L1329] s->hit VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->hit=0, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1329] COND FALSE !(s->hit) [L1332] s->state = 4400 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1334] s->init_num = 0 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4384, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={1:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND TRUE s->state == 4400 [L1338] EXPR s->s3 [L1338] EXPR (s->s3)->tmp.new_cipher [L1338] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={1:0}, ((s->s3)->tmp.new_cipher)->algorithms=20529, (s->s3)->tmp.new_cipher={20511:0}, blastFlag=2, init=1, ret=1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1338] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1341] ret = __VERIFIER_nondet_int() [L1342] COND TRUE blastFlag == 2 [L1343] blastFlag = 3 VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1347] COND FALSE !(ret <= 0) VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1353] s->state = 4416 [L1354] s->init_num = 0 VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4400, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={1:0}, blastFlag=3, init=1, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND TRUE s->state == 4416 [L1358] ret = __VERIFIER_nondet_int() [L1359] COND TRUE blastFlag == 3 [L1360] blastFlag = 4 VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1364] COND FALSE !(ret <= 0) [L1369] s->state = 4432 [L1370] s->init_num = 0 VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1371] COND FALSE !(! tmp___6) VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20505, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->s3={20495:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4416, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={1:0}, blastFlag=4, init=1, ret=7, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1172] COND TRUE s->state == 4432 [L1380] ret = __VERIFIER_nondet_int() [L1381] COND TRUE blastFlag == 4 VAL [={1:0}, blastFlag=4, init=1, ret=0, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1643] __VERIFIER_error() VAL [={1:0}, blastFlag=4, init=1, ret=0, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20492:0}, state=4432, tmp=0, tmp___0={20498:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] - StatisticsResult: Ultimate Automizer benchmark data CFG has 4 procedures, 140 locations, 1 error locations. UNSAFE Result, 10.7s OverallTime, 25 OverallIterations, 6 TraceHistogramMax, 5.8s AutomataDifference, 0.0s DeadEndRemovalTime, 0.0s HoareAnnotationTime, HoareTripleCheckerStatistics: 5114 SDtfs, 2296 SDslu, 6858 SDs, 0 SdLazy, 4107 SolverSat, 172 SolverUnsat, 0 SolverUnknown, 0 SolverNotchecked, 4.3s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 154 GetRequests, 48 SyntacticMatches, 36 SemanticMatches, 70 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.7s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=717occurred in iteration=24, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 0.3s AutomataMinimizationTime, 24 MinimizatonAttempts, 1670 StatesRemovedByMinimization, 20 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TraceCheckStatistics: 0.1s SsaConstructionTime, 0.5s SatisfiabilityAnalysisTime, 1.2s InterpolantComputationTime, 1933 NumberOfCodeBlocks, 1933 NumberOfCodeBlocksAsserted, 25 NumberOfCheckSat, 1791 ConstructedInterpolants, 0 QuantifiedInterpolants, 397585 SizeOfPredicates, 0 NumberOfNonLiveVariables, 0 ConjunctsInSsa, 0 ConjunctsInUnsatCore, 24 InterpolantComputations, 24 PerfectInterpolantSequences, 1286/1286 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces Received shutdown request... ### Bit-precise run ### This is Ultimate 0.1.23-aa41828 [2018-11-22 23:05:08,657 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-22 23:05:08,658 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-22 23:05:08,668 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-22 23:05:08,668 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-22 23:05:08,669 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-22 23:05:08,670 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-22 23:05:08,671 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-22 23:05:08,672 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-22 23:05:08,673 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-22 23:05:08,674 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-22 23:05:08,674 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-22 23:05:08,675 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-22 23:05:08,676 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-22 23:05:08,677 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-22 23:05:08,677 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-22 23:05:08,678 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-22 23:05:08,679 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-22 23:05:08,680 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-22 23:05:08,682 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-22 23:05:08,683 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-22 23:05:08,684 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-22 23:05:08,686 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-22 23:05:08,686 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-22 23:05:08,687 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-22 23:05:08,687 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-22 23:05:08,688 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-22 23:05:08,689 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-22 23:05:08,690 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-22 23:05:08,690 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-22 23:05:08,691 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-22 23:05:08,691 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-22 23:05:08,691 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-22 23:05:08,691 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-22 23:05:08,692 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-22 23:05:08,694 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-22 23:05:08,694 INFO L98 SettingsManager]: Beginning loading settings from /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Bitvector.epf [2018-11-22 23:05:08,705 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-22 23:05:08,705 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-22 23:05:08,706 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-22 23:05:08,706 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-22 23:05:08,707 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-22 23:05:08,707 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-22 23:05:08,707 INFO L133 SettingsManager]: * Use SBE=true [2018-11-22 23:05:08,707 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-22 23:05:08,707 INFO L133 SettingsManager]: * sizeof long=4 [2018-11-22 23:05:08,707 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-11-22 23:05:08,707 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-22 23:05:08,708 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-22 23:05:08,708 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-22 23:05:08,708 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-22 23:05:08,708 INFO L133 SettingsManager]: * Use bitvectors instead of ints=true [2018-11-22 23:05:08,708 INFO L133 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2018-11-22 23:05:08,708 INFO L133 SettingsManager]: * sizeof long double=12 [2018-11-22 23:05:08,708 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-22 23:05:08,709 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-22 23:05:08,711 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-22 23:05:08,711 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-22 23:05:08,711 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-22 23:05:08,711 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-22 23:05:08,711 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-22 23:05:08,711 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-22 23:05:08,711 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-22 23:05:08,712 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-22 23:05:08,712 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-22 23:05:08,712 INFO L133 SettingsManager]: * Trace refinement strategy=WOLF [2018-11-22 23:05:08,712 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-22 23:05:08,712 INFO L133 SettingsManager]: * Command for external solver=cvc4nyu --tear-down-incremental --rewrite-divk --print-success --lang smt [2018-11-22 23:05:08,712 INFO L133 SettingsManager]: * Logic for external solver=AUFBV [2018-11-22 23:05:08,712 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 32bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> 1420a5dac3676d838e2b742b3a84faa6df74a9e1 [2018-11-22 23:05:08,747 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-22 23:05:08,758 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-22 23:05:08,762 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-22 23:05:08,763 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-22 23:05:08,763 INFO L276 PluginConnector]: CDTParser initialized [2018-11-22 23:05:08,764 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/../../sv-benchmarks/c/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c [2018-11-22 23:05:08,810 INFO L221 CDTParser]: Created temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data/9ff431a27/84fc4b9887f2428aaad63f6af9381aff/FLAG58a5a1d87 [2018-11-22 23:05:09,216 INFO L307 CDTParser]: Found 1 translation units. [2018-11-22 23:05:09,217 INFO L161 CDTParser]: Scanning /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/sv-benchmarks/c/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c [2018-11-22 23:05:09,229 INFO L355 CDTParser]: About to delete temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data/9ff431a27/84fc4b9887f2428aaad63f6af9381aff/FLAG58a5a1d87 [2018-11-22 23:05:09,575 INFO L363 CDTParser]: Successfully deleted /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/data/9ff431a27/84fc4b9887f2428aaad63f6af9381aff [2018-11-22 23:05:09,578 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-22 23:05:09,579 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-22 23:05:09,580 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-22 23:05:09,580 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-22 23:05:09,583 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-22 23:05:09,583 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 22.11 11:05:09" (1/1) ... [2018-11-22 23:05:09,586 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@62c05aee and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:09, skipping insertion in model container [2018-11-22 23:05:09,586 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 22.11 11:05:09" (1/1) ... [2018-11-22 23:05:09,593 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-22 23:05:09,636 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-22 23:05:09,947 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-22 23:05:09,958 INFO L191 MainTranslator]: Completed pre-run [2018-11-22 23:05:10,103 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-22 23:05:10,120 INFO L195 MainTranslator]: Completed translation [2018-11-22 23:05:10,120 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10 WrapperNode [2018-11-22 23:05:10,121 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-22 23:05:10,121 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-22 23:05:10,121 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-22 23:05:10,121 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-22 23:05:10,127 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... [2018-11-22 23:05:10,146 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... [2018-11-22 23:05:10,153 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-22 23:05:10,154 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-22 23:05:10,154 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-22 23:05:10,154 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-22 23:05:10,160 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... [2018-11-22 23:05:10,160 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... [2018-11-22 23:05:10,167 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... [2018-11-22 23:05:10,167 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... [2018-11-22 23:05:10,202 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... [2018-11-22 23:05:10,208 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... [2018-11-22 23:05:10,211 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... [2018-11-22 23:05:10,215 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-22 23:05:10,216 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-22 23:05:10,216 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-22 23:05:10,216 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-22 23:05:10,217 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (1/1) ... No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-22 23:05:10,263 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2018-11-22 23:05:10,264 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-22 23:05:10,264 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-22 23:05:10,264 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE4 [2018-11-22 23:05:10,264 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-11-22 23:05:10,264 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-11-22 23:05:10,265 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2018-11-22 23:05:10,265 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-11-22 23:05:10,265 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-22 23:05:10,265 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-22 23:05:10,265 INFO L130 BoogieDeclarations]: Found specification of procedure ssl3_connect [2018-11-22 23:05:10,265 INFO L138 BoogieDeclarations]: Found implementation of procedure ssl3_connect [2018-11-22 23:05:10,265 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-22 23:05:10,266 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-22 23:05:10,266 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2018-11-22 23:05:10,493 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-22 23:05:10,494 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-22 23:05:12,880 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-22 23:05:12,880 INFO L280 CfgBuilder]: Removed 1 assue(true) statements. [2018-11-22 23:05:12,880 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.11 11:05:12 BoogieIcfgContainer [2018-11-22 23:05:12,880 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-22 23:05:12,881 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-22 23:05:12,881 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-22 23:05:12,884 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-22 23:05:12,884 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 22.11 11:05:09" (1/3) ... [2018-11-22 23:05:12,886 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@4acb074e and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 22.11 11:05:12, skipping insertion in model container [2018-11-22 23:05:12,886 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.11 11:05:10" (2/3) ... [2018-11-22 23:05:12,886 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@4acb074e and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 22.11 11:05:12, skipping insertion in model container [2018-11-22 23:05:12,886 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.11 11:05:12" (3/3) ... [2018-11-22 23:05:12,888 INFO L112 eAbstractionObserver]: Analyzing ICFG s3_clnt.blast.03_false-unreach-call.i.cil.c [2018-11-22 23:05:12,895 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-22 23:05:12,901 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-22 23:05:12,912 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-22 23:05:12,937 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-22 23:05:12,937 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-22 23:05:12,938 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-22 23:05:12,938 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-22 23:05:12,938 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-22 23:05:12,938 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-22 23:05:12,938 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-22 23:05:12,939 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-22 23:05:12,939 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-22 23:05:12,954 INFO L276 IsEmpty]: Start isEmpty. Operand 138 states. [2018-11-22 23:05:12,959 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 31 [2018-11-22 23:05:12,959 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:12,960 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:12,962 INFO L423 AbstractCegarLoop]: === Iteration 1 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:12,965 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:12,966 INFO L82 PathProgramCache]: Analyzing trace with hash 500880985, now seen corresponding path program 1 times [2018-11-22 23:05:12,969 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-22 23:05:12,970 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/cvc4nyu Starting monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-22 23:05:12,985 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:13,075 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:13,085 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-22 23:05:13,119 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-22 23:05:13,119 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-22 23:05:13,124 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:13,125 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-22 23:05:13,128 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-22 23:05:13,139 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-22 23:05:13,139 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:13,141 INFO L87 Difference]: Start difference. First operand 138 states. Second operand 3 states. [2018-11-22 23:05:13,248 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:13,248 INFO L93 Difference]: Finished difference Result 379 states and 634 transitions. [2018-11-22 23:05:13,253 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-22 23:05:13,255 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 30 [2018-11-22 23:05:13,255 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:13,268 INFO L225 Difference]: With dead ends: 379 [2018-11-22 23:05:13,268 INFO L226 Difference]: Without dead ends: 219 [2018-11-22 23:05:13,272 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 29 GetRequests, 28 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:13,290 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 219 states. [2018-11-22 23:05:13,317 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 219 to 219. [2018-11-22 23:05:13,319 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 219 states. [2018-11-22 23:05:13,321 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 219 states to 219 states and 323 transitions. [2018-11-22 23:05:13,323 INFO L78 Accepts]: Start accepts. Automaton has 219 states and 323 transitions. Word has length 30 [2018-11-22 23:05:13,323 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:13,324 INFO L480 AbstractCegarLoop]: Abstraction has 219 states and 323 transitions. [2018-11-22 23:05:13,324 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-22 23:05:13,324 INFO L276 IsEmpty]: Start isEmpty. Operand 219 states and 323 transitions. [2018-11-22 23:05:13,326 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 46 [2018-11-22 23:05:13,327 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:13,327 INFO L402 BasicCegarLoop]: trace histogram [2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:13,327 INFO L423 AbstractCegarLoop]: === Iteration 2 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:13,327 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:13,328 INFO L82 PathProgramCache]: Analyzing trace with hash -1966298573, now seen corresponding path program 1 times [2018-11-22 23:05:13,328 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-22 23:05:13,329 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/cvc4nyu Starting monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-22 23:05:13,345 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:13,418 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:13,424 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-22 23:05:13,458 INFO L134 CoverageAnalysis]: Checked inductivity of 8 backedges. 8 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-22 23:05:13,459 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-22 23:05:13,460 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:13,461 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-22 23:05:13,462 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-22 23:05:13,462 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-22 23:05:13,462 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:13,462 INFO L87 Difference]: Start difference. First operand 219 states and 323 transitions. Second operand 3 states. [2018-11-22 23:05:13,570 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:13,570 INFO L93 Difference]: Finished difference Result 423 states and 632 transitions. [2018-11-22 23:05:13,570 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-22 23:05:13,570 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-22 23:05:13,571 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:13,573 INFO L225 Difference]: With dead ends: 423 [2018-11-22 23:05:13,573 INFO L226 Difference]: Without dead ends: 318 [2018-11-22 23:05:13,574 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 44 GetRequests, 43 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:13,575 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 318 states. [2018-11-22 23:05:13,593 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 318 to 318. [2018-11-22 23:05:13,593 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 318 states. [2018-11-22 23:05:13,595 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 318 states to 318 states and 469 transitions. [2018-11-22 23:05:13,595 INFO L78 Accepts]: Start accepts. Automaton has 318 states and 469 transitions. Word has length 45 [2018-11-22 23:05:13,596 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:13,596 INFO L480 AbstractCegarLoop]: Abstraction has 318 states and 469 transitions. [2018-11-22 23:05:13,596 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-22 23:05:13,596 INFO L276 IsEmpty]: Start isEmpty. Operand 318 states and 469 transitions. [2018-11-22 23:05:13,598 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-22 23:05:13,598 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:13,599 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:13,599 INFO L423 AbstractCegarLoop]: === Iteration 3 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:13,599 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:13,599 INFO L82 PathProgramCache]: Analyzing trace with hash 4919250, now seen corresponding path program 1 times [2018-11-22 23:05:13,600 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-22 23:05:13,600 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/cvc4nyu Starting monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-22 23:05:13,625 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:13,696 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:13,703 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-22 23:05:13,719 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-22 23:05:13,720 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-22 23:05:13,721 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:13,722 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-22 23:05:13,722 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-22 23:05:13,722 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-22 23:05:13,722 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:13,723 INFO L87 Difference]: Start difference. First operand 318 states and 469 transitions. Second operand 3 states. [2018-11-22 23:05:13,815 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:13,815 INFO L93 Difference]: Finished difference Result 624 states and 929 transitions. [2018-11-22 23:05:13,816 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-22 23:05:13,816 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 63 [2018-11-22 23:05:13,816 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:13,818 INFO L225 Difference]: With dead ends: 624 [2018-11-22 23:05:13,818 INFO L226 Difference]: Without dead ends: 420 [2018-11-22 23:05:13,819 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 62 GetRequests, 61 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:13,820 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 420 states. [2018-11-22 23:05:13,838 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 420 to 420. [2018-11-22 23:05:13,838 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 420 states. [2018-11-22 23:05:13,840 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 420 states to 420 states and 619 transitions. [2018-11-22 23:05:13,840 INFO L78 Accepts]: Start accepts. Automaton has 420 states and 619 transitions. Word has length 63 [2018-11-22 23:05:13,841 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:13,841 INFO L480 AbstractCegarLoop]: Abstraction has 420 states and 619 transitions. [2018-11-22 23:05:13,841 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-22 23:05:13,841 INFO L276 IsEmpty]: Start isEmpty. Operand 420 states and 619 transitions. [2018-11-22 23:05:13,843 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 84 [2018-11-22 23:05:13,844 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:13,844 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:13,844 INFO L423 AbstractCegarLoop]: === Iteration 4 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:13,844 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:13,844 INFO L82 PathProgramCache]: Analyzing trace with hash 1622310809, now seen corresponding path program 1 times [2018-11-22 23:05:13,845 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-22 23:05:13,845 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/cvc4nyu Starting monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-22 23:05:13,859 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:13,968 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:13,977 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-22 23:05:14,002 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 29 trivial. 0 not checked. [2018-11-22 23:05:14,002 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-22 23:05:14,004 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:14,004 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-22 23:05:14,005 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-22 23:05:14,006 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-22 23:05:14,006 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:14,006 INFO L87 Difference]: Start difference. First operand 420 states and 619 transitions. Second operand 3 states. [2018-11-22 23:05:14,148 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:14,148 INFO L93 Difference]: Finished difference Result 827 states and 1228 transitions. [2018-11-22 23:05:14,149 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-22 23:05:14,149 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 83 [2018-11-22 23:05:14,149 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:14,151 INFO L225 Difference]: With dead ends: 827 [2018-11-22 23:05:14,151 INFO L226 Difference]: Without dead ends: 521 [2018-11-22 23:05:14,153 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 82 GetRequests, 81 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-22 23:05:14,153 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 521 states. [2018-11-22 23:05:14,166 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 521 to 521. [2018-11-22 23:05:14,167 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 521 states. [2018-11-22 23:05:14,169 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 521 states to 521 states and 768 transitions. [2018-11-22 23:05:14,169 INFO L78 Accepts]: Start accepts. Automaton has 521 states and 768 transitions. Word has length 83 [2018-11-22 23:05:14,170 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:14,170 INFO L480 AbstractCegarLoop]: Abstraction has 521 states and 768 transitions. [2018-11-22 23:05:14,170 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-22 23:05:14,170 INFO L276 IsEmpty]: Start isEmpty. Operand 521 states and 768 transitions. [2018-11-22 23:05:14,172 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 105 [2018-11-22 23:05:14,172 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:14,172 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:14,172 INFO L423 AbstractCegarLoop]: === Iteration 5 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:14,173 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:14,173 INFO L82 PathProgramCache]: Analyzing trace with hash 510391332, now seen corresponding path program 1 times [2018-11-22 23:05:14,174 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-22 23:05:14,174 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/cvc4nyu Starting monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-22 23:05:14,197 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:14,632 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:14,791 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-22 23:05:14,990 WARN L180 SmtUtils]: Spent 169.00 ms on a formula simplification that was a NOOP. DAG size: 31 [2018-11-22 23:05:15,015 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 40 treesize of output 38 [2018-11-22 23:05:15,021 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 35 treesize of output 32 [2018-11-22 23:05:15,036 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,042 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 32 treesize of output 38 [2018-11-22 23:05:15,043 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:15,069 INFO L267 ElimStorePlain]: Start of recursive call 3: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:15,102 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 26 [2018-11-22 23:05:15,119 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,130 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,163 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 4 case distinctions, treesize of input 23 treesize of output 46 [2018-11-22 23:05:15,165 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 4 xjuncts. [2018-11-22 23:05:15,210 INFO L267 ElimStorePlain]: Start of recursive call 5: 1 dim-1 vars, End of recursive call: and 3 xjuncts. [2018-11-22 23:05:15,246 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 3 xjuncts. [2018-11-22 23:05:15,270 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 31 treesize of output 31 [2018-11-22 23:05:15,277 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 18 [2018-11-22 23:05:15,317 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,330 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 27 [2018-11-22 23:05:15,331 INFO L267 ElimStorePlain]: Start of recursive call 9: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:15,342 INFO L267 ElimStorePlain]: Start of recursive call 8: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:15,368 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 31 [2018-11-22 23:05:15,376 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 8 treesize of output 7 [2018-11-22 23:05:15,376 INFO L267 ElimStorePlain]: Start of recursive call 11: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:15,389 INFO L267 ElimStorePlain]: Start of recursive call 10: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:15,400 INFO L267 ElimStorePlain]: Start of recursive call 7: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:15,466 INFO L267 ElimStorePlain]: Start of recursive call 1: 3 dim-0 vars, 1 dim-2 vars, End of recursive call: 3 dim-0 vars, and 4 xjuncts. [2018-11-22 23:05:15,466 INFO L202 ElimStorePlain]: Needed 11 recursive calls to eliminate 4 variables, input treesize:45, output treesize:76 [2018-11-22 23:05:15,596 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,651 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 3 case distinctions, treesize of input 43 treesize of output 65 [2018-11-22 23:05:15,663 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,666 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,681 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,694 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,727 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 3 select indices, 3 select index equivalence classes, 4 disjoint index pairs (out of 3 index pairs), introduced 1 new quantified variables, introduced 3 case distinctions, treesize of input 51 treesize of output 82 [2018-11-22 23:05:15,729 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 3 xjuncts. [2018-11-22 23:05:15,957 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,971 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:15,972 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 40 treesize of output 51 [2018-11-22 23:05:15,973 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:16,066 INFO L267 ElimStorePlain]: Start of recursive call 2: 2 dim-1 vars, End of recursive call: and 3 xjuncts. [2018-11-22 23:05:16,210 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:16,210 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 34 treesize of output 41 [2018-11-22 23:05:16,215 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:16,219 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:16,220 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 38 treesize of output 35 [2018-11-22 23:05:16,220 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:16,227 INFO L267 ElimStorePlain]: Start of recursive call 5: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:16,284 INFO L267 ElimStorePlain]: Start of recursive call 1: 2 dim-0 vars, 2 dim-2 vars, End of recursive call: 3 dim-0 vars, and 4 xjuncts. [2018-11-22 23:05:16,284 INFO L202 ElimStorePlain]: Needed 6 recursive calls to eliminate 4 variables, input treesize:78, output treesize:92 [2018-11-22 23:05:16,550 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 11 [2018-11-22 23:05:16,552 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 11 treesize of output 3 [2018-11-22 23:05:16,552 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:16,553 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:16,554 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:16,554 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 2 variables, input treesize:15, output treesize:3 [2018-11-22 23:05:16,584 INFO L134 CoverageAnalysis]: Checked inductivity of 118 backedges. 32 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-22 23:05:16,584 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-22 23:05:16,587 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:16,587 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [9] imperfect sequences [] total 9 [2018-11-22 23:05:16,587 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-22 23:05:16,587 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-22 23:05:16,588 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=18, Invalid=54, Unknown=0, NotChecked=0, Total=72 [2018-11-22 23:05:16,588 INFO L87 Difference]: Start difference. First operand 521 states and 768 transitions. Second operand 9 states. [2018-11-22 23:05:29,124 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:29,124 INFO L93 Difference]: Finished difference Result 1013 states and 1495 transitions. [2018-11-22 23:05:29,126 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 9 states. [2018-11-22 23:05:29,127 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 104 [2018-11-22 23:05:29,127 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:29,128 INFO L225 Difference]: With dead ends: 1013 [2018-11-22 23:05:29,129 INFO L226 Difference]: Without dead ends: 604 [2018-11-22 23:05:29,130 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 108 GetRequests, 96 SyntacticMatches, 0 SemanticMatches, 12 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 10 ImplicationChecksByTransitivity, 0.6s TimeCoverageRelationStatistics Valid=50, Invalid=132, Unknown=0, NotChecked=0, Total=182 [2018-11-22 23:05:29,131 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 604 states. [2018-11-22 23:05:29,144 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 604 to 529. [2018-11-22 23:05:29,144 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 529 states. [2018-11-22 23:05:29,146 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 529 states to 529 states and 781 transitions. [2018-11-22 23:05:29,146 INFO L78 Accepts]: Start accepts. Automaton has 529 states and 781 transitions. Word has length 104 [2018-11-22 23:05:29,146 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:29,146 INFO L480 AbstractCegarLoop]: Abstraction has 529 states and 781 transitions. [2018-11-22 23:05:29,146 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-22 23:05:29,146 INFO L276 IsEmpty]: Start isEmpty. Operand 529 states and 781 transitions. [2018-11-22 23:05:29,148 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 106 [2018-11-22 23:05:29,148 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:29,148 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:29,149 INFO L423 AbstractCegarLoop]: === Iteration 6 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:29,149 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:29,149 INFO L82 PathProgramCache]: Analyzing trace with hash -1655398293, now seen corresponding path program 1 times [2018-11-22 23:05:29,149 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-22 23:05:29,149 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/cvc4nyu Starting monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-22 23:05:29,168 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:29,546 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:29,708 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-22 23:05:29,869 WARN L180 SmtUtils]: Spent 140.00 ms on a formula simplification that was a NOOP. DAG size: 31 [2018-11-22 23:05:29,884 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 40 treesize of output 38 [2018-11-22 23:05:29,892 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 35 treesize of output 32 [2018-11-22 23:05:29,902 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:29,908 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 32 treesize of output 38 [2018-11-22 23:05:29,908 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:29,925 INFO L267 ElimStorePlain]: Start of recursive call 3: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:29,947 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 26 [2018-11-22 23:05:29,952 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:29,962 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:29,994 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 4 case distinctions, treesize of input 23 treesize of output 46 [2018-11-22 23:05:29,994 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 4 xjuncts. [2018-11-22 23:05:30,034 INFO L267 ElimStorePlain]: Start of recursive call 5: 1 dim-1 vars, End of recursive call: and 3 xjuncts. [2018-11-22 23:05:30,066 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 3 xjuncts. [2018-11-22 23:05:30,092 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 31 treesize of output 31 [2018-11-22 23:05:30,095 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 18 [2018-11-22 23:05:30,100 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,104 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 27 [2018-11-22 23:05:30,104 INFO L267 ElimStorePlain]: Start of recursive call 9: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,116 INFO L267 ElimStorePlain]: Start of recursive call 8: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,141 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 31 [2018-11-22 23:05:30,144 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 8 treesize of output 7 [2018-11-22 23:05:30,145 INFO L267 ElimStorePlain]: Start of recursive call 11: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,156 INFO L267 ElimStorePlain]: Start of recursive call 10: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,166 INFO L267 ElimStorePlain]: Start of recursive call 7: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,211 INFO L267 ElimStorePlain]: Start of recursive call 1: 3 dim-0 vars, 1 dim-2 vars, End of recursive call: 2 dim-0 vars, and 3 xjuncts. [2018-11-22 23:05:30,211 INFO L202 ElimStorePlain]: Needed 11 recursive calls to eliminate 4 variables, input treesize:45, output treesize:56 [2018-11-22 23:05:30,289 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,290 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 34 treesize of output 41 [2018-11-22 23:05:30,293 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,299 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,299 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 38 treesize of output 35 [2018-11-22 23:05:30,300 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,307 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,372 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,411 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 3 case distinctions, treesize of input 43 treesize of output 65 [2018-11-22 23:05:30,419 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,427 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,428 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 54 treesize of output 51 [2018-11-22 23:05:30,428 INFO L267 ElimStorePlain]: Start of recursive call 5: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,494 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,497 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,509 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,519 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:30,540 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 3 select indices, 3 select index equivalence classes, 4 disjoint index pairs (out of 3 index pairs), introduced 1 new quantified variables, introduced 3 case distinctions, treesize of input 35 treesize of output 80 [2018-11-22 23:05:30,541 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 3 xjuncts. [2018-11-22 23:05:30,613 INFO L267 ElimStorePlain]: Start of recursive call 4: 2 dim-1 vars, End of recursive call: and 3 xjuncts. [2018-11-22 23:05:30,668 INFO L267 ElimStorePlain]: Start of recursive call 1: 2 dim-0 vars, 2 dim-2 vars, End of recursive call: 3 dim-0 vars, and 4 xjuncts. [2018-11-22 23:05:30,669 INFO L202 ElimStorePlain]: Needed 6 recursive calls to eliminate 4 variables, input treesize:78, output treesize:88 [2018-11-22 23:05:30,898 WARN L180 SmtUtils]: Spent 110.00 ms on a formula simplification that was a NOOP. DAG size: 45 [2018-11-22 23:05:30,948 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 11 [2018-11-22 23:05:30,950 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 11 treesize of output 3 [2018-11-22 23:05:30,950 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,952 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,953 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:30,953 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 2 variables, input treesize:15, output treesize:3 [2018-11-22 23:05:31,000 INFO L134 CoverageAnalysis]: Checked inductivity of 122 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-22 23:05:31,000 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-22 23:05:31,003 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:31,003 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [9] imperfect sequences [] total 9 [2018-11-22 23:05:31,003 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-22 23:05:31,004 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-22 23:05:31,004 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=18, Invalid=54, Unknown=0, NotChecked=0, Total=72 [2018-11-22 23:05:31,004 INFO L87 Difference]: Start difference. First operand 529 states and 781 transitions. Second operand 9 states. [2018-11-22 23:05:43,983 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:05:43,983 INFO L93 Difference]: Finished difference Result 1010 states and 1491 transitions. [2018-11-22 23:05:43,985 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 9 states. [2018-11-22 23:05:43,985 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 105 [2018-11-22 23:05:43,985 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:05:43,987 INFO L225 Difference]: With dead ends: 1010 [2018-11-22 23:05:43,987 INFO L226 Difference]: Without dead ends: 601 [2018-11-22 23:05:43,988 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 109 GetRequests, 97 SyntacticMatches, 0 SemanticMatches, 12 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 10 ImplicationChecksByTransitivity, 0.6s TimeCoverageRelationStatistics Valid=50, Invalid=132, Unknown=0, NotChecked=0, Total=182 [2018-11-22 23:05:43,989 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 601 states. [2018-11-22 23:05:43,999 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 601 to 530. [2018-11-22 23:05:43,999 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 530 states. [2018-11-22 23:05:44,001 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 530 states to 530 states and 782 transitions. [2018-11-22 23:05:44,001 INFO L78 Accepts]: Start accepts. Automaton has 530 states and 782 transitions. Word has length 105 [2018-11-22 23:05:44,001 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:05:44,001 INFO L480 AbstractCegarLoop]: Abstraction has 530 states and 782 transitions. [2018-11-22 23:05:44,001 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-22 23:05:44,002 INFO L276 IsEmpty]: Start isEmpty. Operand 530 states and 782 transitions. [2018-11-22 23:05:44,003 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 119 [2018-11-22 23:05:44,003 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:05:44,004 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:05:44,004 INFO L423 AbstractCegarLoop]: === Iteration 7 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:05:44,004 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:05:44,004 INFO L82 PathProgramCache]: Analyzing trace with hash -480842948, now seen corresponding path program 1 times [2018-11-22 23:05:44,005 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-22 23:05:44,005 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/cvc4nyu Starting monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-22 23:05:44,021 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:05:54,654 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-22 23:05:55,388 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-22 23:05:55,404 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 13 treesize of output 10 [2018-11-22 23:05:55,406 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 10 treesize of output 9 [2018-11-22 23:05:55,406 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:55,408 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:55,414 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:55,414 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 1 variables, input treesize:17, output treesize:13 [2018-11-22 23:05:55,431 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 23 treesize of output 18 [2018-11-22 23:05:55,433 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:55,434 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:55,435 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 2 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 37 [2018-11-22 23:05:55,436 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:55,442 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:55,451 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:55,451 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 1 variables, input treesize:26, output treesize:22 [2018-11-22 23:05:55,473 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 22 treesize of output 16 [2018-11-22 23:05:55,476 INFO L701 Elim1Store]: detected not equals via solver [2018-11-22 23:05:55,476 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 16 treesize of output 8 [2018-11-22 23:05:55,477 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-22 23:05:55,480 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:55,481 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-22 23:05:55,481 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 2 variables, input treesize:22, output treesize:3 [2018-11-22 23:05:55,499 INFO L134 CoverageAnalysis]: Checked inductivity of 145 backedges. 111 proven. 0 refuted. 0 times theorem prover too weak. 34 trivial. 0 not checked. [2018-11-22 23:05:55,500 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-22 23:05:55,506 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-22 23:05:55,506 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [8] imperfect sequences [] total 8 [2018-11-22 23:05:55,507 INFO L459 AbstractCegarLoop]: Interpolant automaton has 8 states [2018-11-22 23:05:55,507 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 8 interpolants. [2018-11-22 23:05:55,507 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=16, Invalid=40, Unknown=0, NotChecked=0, Total=56 [2018-11-22 23:05:55,507 INFO L87 Difference]: Start difference. First operand 530 states and 782 transitions. Second operand 8 states. [2018-11-22 23:06:08,009 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-22 23:06:08,009 INFO L93 Difference]: Finished difference Result 1410 states and 2086 transitions. [2018-11-22 23:06:08,012 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 8 states. [2018-11-22 23:06:08,012 INFO L78 Accepts]: Start accepts. Automaton has 8 states. Word has length 118 [2018-11-22 23:06:08,012 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-22 23:06:08,016 INFO L225 Difference]: With dead ends: 1410 [2018-11-22 23:06:08,016 INFO L226 Difference]: Without dead ends: 902 [2018-11-22 23:06:08,017 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 121 GetRequests, 111 SyntacticMatches, 0 SemanticMatches, 10 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 3 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=44, Invalid=88, Unknown=0, NotChecked=0, Total=132 [2018-11-22 23:06:08,018 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 902 states. [2018-11-22 23:06:08,043 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 902 to 614. [2018-11-22 23:06:08,043 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 614 states. [2018-11-22 23:06:08,045 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 614 states to 614 states and 922 transitions. [2018-11-22 23:06:08,045 INFO L78 Accepts]: Start accepts. Automaton has 614 states and 922 transitions. Word has length 118 [2018-11-22 23:06:08,046 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-22 23:06:08,046 INFO L480 AbstractCegarLoop]: Abstraction has 614 states and 922 transitions. [2018-11-22 23:06:08,046 INFO L481 AbstractCegarLoop]: Interpolant automaton has 8 states. [2018-11-22 23:06:08,046 INFO L276 IsEmpty]: Start isEmpty. Operand 614 states and 922 transitions. [2018-11-22 23:06:08,047 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 119 [2018-11-22 23:06:08,047 INFO L394 BasicCegarLoop]: Found error trace [2018-11-22 23:06:08,048 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-22 23:06:08,048 INFO L423 AbstractCegarLoop]: === Iteration 8 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-22 23:06:08,048 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-22 23:06:08,048 INFO L82 PathProgramCache]: Analyzing trace with hash 2127944510, now seen corresponding path program 1 times [2018-11-22 23:06:08,048 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-22 23:06:08,049 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/cvc4nyu Starting monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-22 23:06:08,070 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-22 23:06:10,602 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-22 23:06:13,642 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-22 23:06:14,233 INFO L469 BasicCegarLoop]: Counterexample might be feasible ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv0 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv0 32)] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume true; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] RET #544#return; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret138 := main(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; VAL [main_~s~0.base=(_ bv33554433 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |main_#t~malloc3.base|=(_ bv33554433 32), |main_#t~malloc3.offset|=(_ bv0 32), |main_#t~malloc4.base|=(_ bv2147483650 32), |main_#t~malloc4.offset|=(_ bv0 32), |main_#t~malloc5.base|=(_ bv3 32), |main_#t~malloc5.offset|=(_ bv0 32), |main_#t~malloc6.base|=(_ bv2 32), |main_#t~malloc6.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv0 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem21.base|=(_ bv0 32), |ssl3_connect_#t~mem21.offset|=(_ bv1 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv12292 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 12292bv32 == #t~mem29;havoc #t~mem29; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32);call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);havoc #t~mem62.base, #t~mem62.offset;havoc #t~mem63; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem64|=(_ bv768 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64));havoc #t~mem64;call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32);call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem65.base|=(_ bv0 32), |ssl3_connect_#t~mem65.offset|=(_ bv1 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset));havoc #t~mem65.base, #t~mem65.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___4~0); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___5~0);call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);havoc #t~mem67.base, #t~mem67.offset;havoc #t~mem68;call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4368bv32 == #t~mem34;havoc #t~mem34; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem70.base|=(_ bv1 32), |ssl3_connect_#t~mem70.offset|=(_ bv0 32), |ssl3_connect_#t~mem71.base|=(_ bv0 32), |ssl3_connect_#t~mem71.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem70.base, #t~mem70.offset;havoc #t~mem71.base, #t~mem71.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4384bv32 == #t~mem36;havoc #t~mem36; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet72;havoc #t~nondet72; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem73|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != #t~mem73);havoc #t~mem73;call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4400bv32 == #t~mem38;havoc #t~mem38; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32);call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem74.base|=(_ bv33554433 32), |ssl3_connect_#t~mem74.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem75.base|=(_ bv33554433 32), |ssl3_connect_#t~mem75.offset|=(_ bv52 32), |ssl3_connect_#t~mem76|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(256bv32, #t~mem76));havoc #t~mem75.base, #t~mem75.offset;havoc #t~mem74.base, #t~mem74.offset;havoc #t~mem76;~ret~0 := #t~nondet77;havoc #t~nondet77; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 2bv32 == ~blastFlag~0;~blastFlag~0 := 3bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] WARNING: YOUR LOGFILE WAS TOO LONG, SOME LINES IN THE MIDDLE WERE REMOVED. [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1338] havoc #t~mem76; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- [2018-11-22 23:06:14,888 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# [2018-11-22 23:06:14,889 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem67; [L1287] havoc #t~mem68; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem70; [L1306] havoc #t~mem71; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1338] havoc #t~mem76; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=0, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={33554434:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={33554433:0}, SSLv3_client_data={33554434:0}] [L1080] BUF_MEM *buf ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 = __VERIFIER_nondet_int() ; [L1093] int tmp___4 = __VERIFIER_nondet_int() ; [L1094] int tmp___5 = __VERIFIER_nondet_int() ; [L1095] int tmp___6 = __VERIFIER_nondet_int() ; [L1096] int tmp___7 = __VERIFIER_nondet_int() ; [L1097] int tmp___8 = __VERIFIER_nondet_int() ; [L1098] long tmp___9 = __VERIFIER_nondet_long() ; [L1099] int blastFlag ; [L1102] blastFlag = 0 [L1103] s->hit=__VERIFIER_nondet_int () [L1104] s->state = 12292 [L1105] tmp = __VERIFIER_nondet_int() [L1106] cb = (void (*)())((void *)0) [L1107] ret = -1 [L1108] skip = 0 [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->info_callback={0:1}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=12292, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] EXPR s->version VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->version=768, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->init_buf={0:1}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1274] COND FALSE !(! tmp___4) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1280] COND FALSE !(! tmp___5) [L1286] s->state = 4368 [L1287] EXPR s->ctx [L1287] EXPR (s->ctx)->stats.sess_connect [L1287] (s->ctx)->stats.sess_connect += 1 [L1288] s->init_num = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4368, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND TRUE s->state == 4368 [L1292] s->shutdown = 0 [L1293] ret = __VERIFIER_nondet_int() [L1294] COND TRUE blastFlag == 0 [L1295] blastFlag = 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1299] COND FALSE !(ret <= 0) [L1304] s->state = 4384 [L1305] s->init_num = 0 [L1306] EXPR s->bbio [L1306] EXPR s->wbio VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->bbio={1:0}, s->wbio={0:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1306] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4384, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND TRUE s->state == 4384 [L1314] ret = __VERIFIER_nondet_int() [L1315] COND TRUE blastFlag == 1 [L1316] blastFlag = 2 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1324] COND FALSE !(ret <= 0) [L1329] s->hit VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->hit=0, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1329] COND FALSE !(s->hit) [L1332] s->state = 4400 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1334] s->init_num = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4400, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND TRUE s->state == 4400 [L1338] EXPR s->s3 [L1338] EXPR (s->s3)->tmp.new_cipher [L1338] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={0:1}, ((s->s3)->tmp.new_cipher)->algorithms=0, (s->s3)->tmp.new_cipher={33554433:52}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1338] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1341] ret = __VERIFIER_nondet_int() [L1342] COND TRUE blastFlag == 2 [L1343] blastFlag = 3 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1347] COND FALSE !(ret <= 0) VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1353] s->state = 4416 [L1354] s->init_num = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4416, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND TRUE s->state == 4416 [L1358] ret = __VERIFIER_nondet_int() [L1359] COND TRUE blastFlag == 3 [L1360] blastFlag = 4 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1364] COND FALSE !(ret <= 0) [L1369] s->state = 4432 [L1370] s->init_num = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1371] COND FALSE !(! tmp___6) VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4432, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1172] COND TRUE s->state == 4432 [L1380] ret = __VERIFIER_nondet_int() [L1381] COND TRUE blastFlag == 4 VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1643] __VERIFIER_error() VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] ----- [2018-11-22 23:06:15,139 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 22.11 11:06:15 BoogieIcfgContainer [2018-11-22 23:06:15,139 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2018-11-22 23:06:15,139 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2018-11-22 23:06:15,139 INFO L271 PluginConnector]: Initializing Witness Printer... [2018-11-22 23:06:15,139 INFO L276 PluginConnector]: Witness Printer initialized [2018-11-22 23:06:15,140 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.11 11:05:12" (3/4) ... [2018-11-22 23:06:15,144 INFO L138 WitnessPrinter]: Generating witness for reachability counterexample ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv0 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv0 32)] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume true; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] RET #544#return; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret138 := main(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; VAL [main_~s~0.base=(_ bv33554433 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |main_#t~malloc3.base|=(_ bv33554433 32), |main_#t~malloc3.offset|=(_ bv0 32), |main_#t~malloc4.base|=(_ bv2147483650 32), |main_#t~malloc4.offset|=(_ bv0 32), |main_#t~malloc5.base|=(_ bv3 32), |main_#t~malloc5.offset|=(_ bv0 32), |main_#t~malloc6.base|=(_ bv2 32), |main_#t~malloc6.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv0 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem21.base|=(_ bv0 32), |ssl3_connect_#t~mem21.offset|=(_ bv1 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv12292 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 12292bv32 == #t~mem29;havoc #t~mem29; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32);call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);havoc #t~mem62.base, #t~mem62.offset;havoc #t~mem63; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem64|=(_ bv768 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64));havoc #t~mem64;call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32);call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem65.base|=(_ bv0 32), |ssl3_connect_#t~mem65.offset|=(_ bv1 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset));havoc #t~mem65.base, #t~mem65.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___4~0); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___5~0);call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);havoc #t~mem67.base, #t~mem67.offset;havoc #t~mem68;call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4368bv32 == #t~mem34;havoc #t~mem34; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem70.base|=(_ bv1 32), |ssl3_connect_#t~mem70.offset|=(_ bv0 32), |ssl3_connect_#t~mem71.base|=(_ bv0 32), |ssl3_connect_#t~mem71.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem70.base, #t~mem70.offset;havoc #t~mem71.base, #t~mem71.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4384bv32 == #t~mem36;havoc #t~mem36; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet72;havoc #t~nondet72; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem73|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != #t~mem73);havoc #t~mem73;call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4400bv32 == #t~mem38;havoc #t~mem38; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32);call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem74.base|=(_ bv33554433 32), |ssl3_connect_#t~mem74.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem75.base|=(_ bv33554433 32), |ssl3_connect_#t~mem75.offset|=(_ bv52 32), |ssl3_connect_#t~mem76|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(256bv32, #t~mem76));havoc #t~mem75.base, #t~mem75.offset;havoc #t~mem74.base, #t~mem74.offset;havoc #t~mem76;~ret~0 := #t~nondet77;havoc #t~nondet77; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 2bv32 == ~blastFlag~0;~blastFlag~0 := 3bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem39|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem40|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4416bv32 == #t~mem40;havoc #t~mem40; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet78;havoc #t~nondet78; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 3bv32 == ~blastFlag~0;~blastFlag~0 := 4bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___6~0); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem39|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem40|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem41|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem42|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4432bv32 == #t~mem42;havoc #t~mem42; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet79;havoc #t~nondet79; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4bv32 == ~blastFlag~0; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=0bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; [L1042] ~init~0 := 1bv32; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32); [L1043] call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32); [L1072] call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32); [L1073] call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc3.base=33554433bv32, #t~malloc3.offset=0bv32, #t~malloc4.base=2147483650bv32, #t~malloc4.offset=0bv32, #t~malloc5.base=3bv32, #t~malloc5.offset=0bv32, #t~malloc6.base=2bv32, #t~malloc6.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32, ~s~0.base=33554433bv32, ~s~0.offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] havoc ~buf~0.base, ~buf~0.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset; [L1089] havoc #t~nondet9.base, #t~nondet9.offset; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); [L1103] havoc #t~nondet19; [L1104] call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0.base, ~cb~0.offset := 0bv32, 0bv32; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32); [L1110] call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem21.base=0bv32, #t~mem21.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110-L1118] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset); [L1110] havoc #t~mem21.base, #t~mem21.offset; [L1111] call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset; [L1111] havoc #t~mem22.base, #t~mem22.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] havoc #t~mem27; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume 12292bv32 == #t~mem29; [L1133] havoc #t~mem29; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32); [L1237] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1238] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1238] call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] havoc #t~mem62.base, #t~mem62.offset; [L1238] havoc #t~mem63; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244-L1248] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249-L1254] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64)); [L1249] havoc #t~mem64; [L1255] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32); [L1256] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem65.base=0bv32, #t~mem65.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256-L1273] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset)); [L1256] havoc #t~mem65.base, #t~mem65.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274-L1279] assume !(0bv32 == ~tmp___4~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280-L1285] assume !(0bv32 == ~tmp___5~0); [L1286] call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1287] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1287] call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] havoc #t~mem67.base, #t~mem67.offset; [L1287] havoc #t~mem68; [L1288] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume 4368bv32 == #t~mem34; [L1148] havoc #t~mem34; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294-L1298] assume 0bv32 == ~blastFlag~0; [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299-L1303] assume !~bvsle32(~ret~0, 0bv32); [L1304] call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1305] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1306] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32); [L1306] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem70.base=1bv32, #t~mem70.offset=0bv32, #t~mem71.base=0bv32, #t~mem71.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306-L1310] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset); [L1306] havoc #t~mem70.base, #t~mem70.offset; [L1306] havoc #t~mem71.base, #t~mem71.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume 4384bv32 == #t~mem36; [L1154] havoc #t~mem36; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315-L1323] assume 1bv32 == ~blastFlag~0; [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324-L1328] assume !~bvsle32(~ret~0, 0bv32); [L1329] call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] assume !(0bv32 != #t~mem73); [L1329] havoc #t~mem73; [L1332] call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume 4400bv32 == #t~mem38; [L1160] havoc #t~mem38; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1338] call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32); [L1338] call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem74.base=33554433bv32, #t~mem74.offset=4294966500bv32, #t~mem75.base=33554433bv32, #t~mem75.offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] assume !(0bv32 != ~bvand32(256bv32, #t~mem76)); [L1338] havoc #t~mem75.base, #t~mem75.offset; [L1338] havoc #t~mem74.base, #t~mem74.offset; [L1338] havoc #t~mem76; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342-L1346] assume 2bv32 == ~blastFlag~0; [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347-L1351] assume !~bvsle32(~ret~0, 0bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1354] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume 4416bv32 == #t~mem40; [L1166] havoc #t~mem40; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359-L1363] assume 3bv32 == ~blastFlag~0; [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364-L1368] assume !~bvsle32(~ret~0, 0bv32); [L1369] call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1370] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371-L1376] assume !(0bv32 == ~tmp___6~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume !(4416bv32 == #t~mem40); [L1166] havoc #t~mem40; [L1169] call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169-L1589] assume !(4417bv32 == #t~mem41); [L1169] havoc #t~mem41; [L1172] call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172-L1588] assume 4432bv32 == #t~mem42; [L1172] havoc #t~mem42; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381-L1385] assume 4bv32 == ~blastFlag~0; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=0bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; [L1042] ~init~0 := 1bv32; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32); [L1043] call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32); [L1072] call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32); [L1073] call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc3.base=33554433bv32, #t~malloc3.offset=0bv32, #t~malloc4.base=2147483650bv32, #t~malloc4.offset=0bv32, #t~malloc5.base=3bv32, #t~malloc5.offset=0bv32, #t~malloc6.base=2bv32, #t~malloc6.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32, ~s~0.base=33554433bv32, ~s~0.offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] havoc ~buf~0.base, ~buf~0.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset; [L1089] havoc #t~nondet9.base, #t~nondet9.offset; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); [L1103] havoc #t~nondet19; [L1104] call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0.base, ~cb~0.offset := 0bv32, 0bv32; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32); [L1110] call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem21.base=0bv32, #t~mem21.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110-L1118] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset); [L1110] havoc #t~mem21.base, #t~mem21.offset; [L1111] call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset; [L1111] havoc #t~mem22.base, #t~mem22.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] havoc #t~mem27; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume 12292bv32 == #t~mem29; [L1133] havoc #t~mem29; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32); [L1237] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1238] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1238] call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] havoc #t~mem62.base, #t~mem62.offset; [L1238] havoc #t~mem63; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244-L1248] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249-L1254] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64)); [L1249] havoc #t~mem64; [L1255] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32); [L1256] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem65.base=0bv32, #t~mem65.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256-L1273] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset)); [L1256] havoc #t~mem65.base, #t~mem65.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274-L1279] assume !(0bv32 == ~tmp___4~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280-L1285] assume !(0bv32 == ~tmp___5~0); [L1286] call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1287] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1287] call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] havoc #t~mem67.base, #t~mem67.offset; [L1287] havoc #t~mem68; [L1288] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume 4368bv32 == #t~mem34; [L1148] havoc #t~mem34; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294-L1298] assume 0bv32 == ~blastFlag~0; [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299-L1303] assume !~bvsle32(~ret~0, 0bv32); [L1304] call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1305] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1306] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32); [L1306] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem70.base=1bv32, #t~mem70.offset=0bv32, #t~mem71.base=0bv32, #t~mem71.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306-L1310] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset); [L1306] havoc #t~mem70.base, #t~mem70.offset; [L1306] havoc #t~mem71.base, #t~mem71.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume 4384bv32 == #t~mem36; [L1154] havoc #t~mem36; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315-L1323] assume 1bv32 == ~blastFlag~0; [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324-L1328] assume !~bvsle32(~ret~0, 0bv32); [L1329] call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] assume !(0bv32 != #t~mem73); [L1329] havoc #t~mem73; [L1332] call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume 4400bv32 == #t~mem38; [L1160] havoc #t~mem38; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1338] call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32); [L1338] call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem74.base=33554433bv32, #t~mem74.offset=4294966500bv32, #t~mem75.base=33554433bv32, #t~mem75.offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] assume !(0bv32 != ~bvand32(256bv32, #t~mem76)); [L1338] havoc #t~mem75.base, #t~mem75.offset; [L1338] havoc #t~mem74.base, #t~mem74.offset; [L1338] havoc #t~mem76; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342-L1346] assume 2bv32 == ~blastFlag~0; [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347-L1351] assume !~bvsle32(~ret~0, 0bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1354] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume 4416bv32 == #t~mem40; [L1166] havoc #t~mem40; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359-L1363] assume 3bv32 == ~blastFlag~0; [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364-L1368] assume !~bvsle32(~ret~0, 0bv32); [L1369] call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1370] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371-L1376] assume !(0bv32 == ~tmp___6~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem128; [L1602] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume !(4416bv32 == #t~mem40); [L1166] havoc #t~mem40; [L1169] call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169-L1589] assume !(4417bv32 == #t~mem41); [L1169] havoc #t~mem41; [L1172] call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172-L1588] assume 4432bv32 == #t~mem42; [L1172] havoc #t~mem42; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381-L1385] assume 4bv32 == ~blastFlag~0; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem67; [L1287] havoc #t~mem68; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem70; [L1306] havoc #t~mem71; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1338] havoc #t~mem76; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem67; [L1287] havoc #t~mem68; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem70; [L1306] havoc #t~mem71; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1338] havoc #t~mem76; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem67; [L1287] havoc #t~mem68; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem70; [L1306] havoc #t~mem71; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1338] havoc #t~mem76; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- [2018-11-22 23:06:20,129 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# [2018-11-22 23:06:20,130 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem67; [L1287] havoc #t~mem68; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem70; [L1306] havoc #t~mem71; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1338] havoc #t~mem76; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem128; [L1602] havoc #t~mem127; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=0, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={33554434:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={33554433:0}, SSLv3_client_data={33554434:0}] [L1080] BUF_MEM *buf ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 = __VERIFIER_nondet_int() ; [L1093] int tmp___4 = __VERIFIER_nondet_int() ; [L1094] int tmp___5 = __VERIFIER_nondet_int() ; [L1095] int tmp___6 = __VERIFIER_nondet_int() ; [L1096] int tmp___7 = __VERIFIER_nondet_int() ; [L1097] int tmp___8 = __VERIFIER_nondet_int() ; [L1098] long tmp___9 = __VERIFIER_nondet_long() ; [L1099] int blastFlag ; [L1102] blastFlag = 0 [L1103] s->hit=__VERIFIER_nondet_int () [L1104] s->state = 12292 [L1105] tmp = __VERIFIER_nondet_int() [L1106] cb = (void (*)())((void *)0) [L1107] ret = -1 [L1108] skip = 0 [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->info_callback={0:1}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=12292, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] EXPR s->version VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->version=768, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->init_buf={0:1}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1274] COND FALSE !(! tmp___4) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1280] COND FALSE !(! tmp___5) [L1286] s->state = 4368 [L1287] EXPR s->ctx [L1287] EXPR (s->ctx)->stats.sess_connect [L1287] (s->ctx)->stats.sess_connect += 1 [L1288] s->init_num = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4368, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND TRUE s->state == 4368 [L1292] s->shutdown = 0 [L1293] ret = __VERIFIER_nondet_int() [L1294] COND TRUE blastFlag == 0 [L1295] blastFlag = 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1299] COND FALSE !(ret <= 0) [L1304] s->state = 4384 [L1305] s->init_num = 0 [L1306] EXPR s->bbio [L1306] EXPR s->wbio VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->bbio={1:0}, s->wbio={0:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1306] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4384, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND TRUE s->state == 4384 [L1314] ret = __VERIFIER_nondet_int() [L1315] COND TRUE blastFlag == 1 [L1316] blastFlag = 2 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1324] COND FALSE !(ret <= 0) [L1329] s->hit VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->hit=0, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1329] COND FALSE !(s->hit) [L1332] s->state = 4400 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1334] s->init_num = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4400, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND TRUE s->state == 4400 [L1338] EXPR s->s3 [L1338] EXPR (s->s3)->tmp.new_cipher [L1338] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={0:1}, ((s->s3)->tmp.new_cipher)->algorithms=0, (s->s3)->tmp.new_cipher={33554433:52}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1338] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1341] ret = __VERIFIER_nondet_int() [L1342] COND TRUE blastFlag == 2 [L1343] blastFlag = 3 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1347] COND FALSE !(ret <= 0) VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1353] s->state = 4416 [L1354] s->init_num = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4416, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND TRUE s->state == 4416 [L1358] ret = __VERIFIER_nondet_int() [L1359] COND TRUE blastFlag == 3 [L1360] blastFlag = 4 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1364] COND FALSE !(ret <= 0) [L1369] s->state = 4432 [L1370] s->init_num = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1371] COND FALSE !(! tmp___6) VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4432, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1172] COND TRUE s->state == 4432 [L1380] ret = __VERIFIER_nondet_int() [L1381] COND TRUE blastFlag == 4 VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1643] __VERIFIER_error() VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] ----- [2018-11-22 23:06:21,699 INFO L145 WitnessManager]: Wrote witness to /tmp/vcloud-vcloud-master/worker/working_dir_95ae825e-c266-4d32-869a-ef9c14c623bc/bin-2019/uautomizer/witness.graphml [2018-11-22 23:06:21,700 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-22 23:06:21,700 INFO L168 Benchmark]: Toolchain (without parser) took 72121.44 ms. Allocated memory was 1.0 GB in the beginning and 1.3 GB in the end (delta: 297.8 MB). Free memory was 944.4 MB in the beginning and 849.9 MB in the end (delta: 94.4 MB). Peak memory consumption was 392.2 MB. Max. memory is 11.5 GB. [2018-11-22 23:06:21,701 INFO L168 Benchmark]: CDTParser took 0.19 ms. Allocated memory is still 1.0 GB. Free memory is still 978.7 MB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-22 23:06:21,701 INFO L168 Benchmark]: CACSL2BoogieTranslator took 540.78 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 135.8 MB). Free memory was 944.4 MB in the beginning and 1.1 GB in the end (delta: -170.1 MB). Peak memory consumption was 46.9 MB. Max. memory is 11.5 GB. [2018-11-22 23:06:21,701 INFO L168 Benchmark]: Boogie Procedure Inliner took 32.20 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 6.7 MB). Peak memory consumption was 6.7 MB. Max. memory is 11.5 GB. [2018-11-22 23:06:21,702 INFO L168 Benchmark]: Boogie Preprocessor took 62.04 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 13.4 MB). Peak memory consumption was 13.4 MB. Max. memory is 11.5 GB. [2018-11-22 23:06:21,702 INFO L168 Benchmark]: RCFGBuilder took 2664.43 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.0 GB in the end (delta: 78.4 MB). Peak memory consumption was 78.4 MB. Max. memory is 11.5 GB. [2018-11-22 23:06:21,702 INFO L168 Benchmark]: TraceAbstraction took 62257.61 ms. Allocated memory was 1.2 GB in the beginning and 1.3 GB in the end (delta: 162.0 MB). Free memory was 1.0 GB in the beginning and 930.6 MB in the end (delta: 85.3 MB). Peak memory consumption was 247.3 MB. Max. memory is 11.5 GB. [2018-11-22 23:06:21,702 INFO L168 Benchmark]: Witness Printer took 6560.74 ms. Allocated memory is still 1.3 GB. Free memory was 930.6 MB in the beginning and 849.9 MB in the end (delta: 80.6 MB). Peak memory consumption was 80.6 MB. Max. memory is 11.5 GB. [2018-11-22 23:06:21,704 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.19 ms. Allocated memory is still 1.0 GB. Free memory is still 978.7 MB. There was no memory consumed. Max. memory is 11.5 GB. * CACSL2BoogieTranslator took 540.78 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 135.8 MB). Free memory was 944.4 MB in the beginning and 1.1 GB in the end (delta: -170.1 MB). Peak memory consumption was 46.9 MB. Max. memory is 11.5 GB. * Boogie Procedure Inliner took 32.20 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 6.7 MB). Peak memory consumption was 6.7 MB. Max. memory is 11.5 GB. * Boogie Preprocessor took 62.04 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 13.4 MB). Peak memory consumption was 13.4 MB. Max. memory is 11.5 GB. * RCFGBuilder took 2664.43 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.0 GB in the end (delta: 78.4 MB). Peak memory consumption was 78.4 MB. Max. memory is 11.5 GB. * TraceAbstraction took 62257.61 ms. Allocated memory was 1.2 GB in the beginning and 1.3 GB in the end (delta: 162.0 MB). Free memory was 1.0 GB in the beginning and 930.6 MB in the end (delta: 85.3 MB). Peak memory consumption was 247.3 MB. Max. memory is 11.5 GB. * Witness Printer took 6560.74 ms. Allocated memory is still 1.3 GB. Free memory was 930.6 MB in the beginning and 849.9 MB in the end (delta: 80.6 MB). Peak memory consumption was 80.6 MB. Max. memory is 11.5 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - CounterExampleResult [Line: 1643]: a call of __VERIFIER_error() is reachable a call of __VERIFIER_error() is reachable We found a FailurePath: [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=0, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={33554434:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={33554433:0}, SSLv3_client_data={33554434:0}] [L1080] BUF_MEM *buf ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 = __VERIFIER_nondet_int() ; [L1093] int tmp___4 = __VERIFIER_nondet_int() ; [L1094] int tmp___5 = __VERIFIER_nondet_int() ; [L1095] int tmp___6 = __VERIFIER_nondet_int() ; [L1096] int tmp___7 = __VERIFIER_nondet_int() ; [L1097] int tmp___8 = __VERIFIER_nondet_int() ; [L1098] long tmp___9 = __VERIFIER_nondet_long() ; [L1099] int blastFlag ; [L1102] blastFlag = 0 [L1103] s->hit=__VERIFIER_nondet_int () [L1104] s->state = 12292 [L1105] tmp = __VERIFIER_nondet_int() [L1106] cb = (void (*)())((void *)0) [L1107] ret = -1 [L1108] skip = 0 [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->info_callback={0:1}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=12292, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] EXPR s->version VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->version=768, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->init_buf={0:1}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1274] COND FALSE !(! tmp___4) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1280] COND FALSE !(! tmp___5) [L1286] s->state = 4368 [L1287] EXPR s->ctx [L1287] EXPR (s->ctx)->stats.sess_connect [L1287] (s->ctx)->stats.sess_connect += 1 [L1288] s->init_num = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4368, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND TRUE s->state == 4368 [L1292] s->shutdown = 0 [L1293] ret = __VERIFIER_nondet_int() [L1294] COND TRUE blastFlag == 0 [L1295] blastFlag = 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1299] COND FALSE !(ret <= 0) [L1304] s->state = 4384 [L1305] s->init_num = 0 [L1306] EXPR s->bbio [L1306] EXPR s->wbio VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->bbio={1:0}, s->wbio={0:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1306] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4384, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND TRUE s->state == 4384 [L1314] ret = __VERIFIER_nondet_int() [L1315] COND TRUE blastFlag == 1 [L1316] blastFlag = 2 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1324] COND FALSE !(ret <= 0) [L1329] s->hit VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->hit=0, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1329] COND FALSE !(s->hit) [L1332] s->state = 4400 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1334] s->init_num = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4400, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND TRUE s->state == 4400 [L1338] EXPR s->s3 [L1338] EXPR (s->s3)->tmp.new_cipher [L1338] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={0:1}, ((s->s3)->tmp.new_cipher)->algorithms=0, (s->s3)->tmp.new_cipher={33554433:52}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1338] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1341] ret = __VERIFIER_nondet_int() [L1342] COND TRUE blastFlag == 2 [L1343] blastFlag = 3 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1347] COND FALSE !(ret <= 0) VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1353] s->state = 4416 [L1354] s->init_num = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4416, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND TRUE s->state == 4416 [L1358] ret = __VERIFIER_nondet_int() [L1359] COND TRUE blastFlag == 3 [L1360] blastFlag = 4 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1364] COND FALSE !(ret <= 0) [L1369] s->state = 4432 [L1370] s->init_num = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1371] COND FALSE !(! tmp___6) VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4432, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1172] COND TRUE s->state == 4432 [L1380] ret = __VERIFIER_nondet_int() [L1381] COND TRUE blastFlag == 4 VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1643] __VERIFIER_error() VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] - StatisticsResult: Ultimate Automizer benchmark data CFG has 4 procedures, 140 locations, 1 error locations. UNSAFE Result, 62.2s OverallTime, 8 OverallIterations, 6 TraceHistogramMax, 38.5s AutomataDifference, 0.0s DeadEndRemovalTime, 0.0s HoareAnnotationTime, HoareTripleCheckerStatistics: 1566 SDtfs, 1847 SDslu, 2235 SDs, 0 SdLazy, 1648 SolverSat, 111 SolverUnsat, 4 SolverUnknown, 0 SolverNotchecked, 35.9s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 555 GetRequests, 517 SyntacticMatches, 0 SemanticMatches, 38 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 23 ImplicationChecksByTransitivity, 1.4s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=614occurred in iteration=7, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 0.1s AutomataMinimizationTime, 7 MinimizatonAttempts, 434 StatesRemovedByMinimization, 3 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TraceCheckStatistics: 0.2s SsaConstructionTime, 14.0s SatisfiabilityAnalysisTime, 4.3s InterpolantComputationTime, 666 NumberOfCodeBlocks, 666 NumberOfCodeBlocksAsserted, 8 NumberOfCheckSat, 541 ConstructedInterpolants, 12 QuantifiedInterpolants, 224861 SizeOfPredicates, 25 NumberOfNonLiveVariables, 2030 ConjunctsInSsa, 40 ConjunctsInUnsatCore, 7 InterpolantComputations, 7 PerfectInterpolantSequences, 487/487 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! Received shutdown request...