./Ultimate.py --spec ../../sv-benchmarks/c/properties/unreach-call.prp --file ../../sv-benchmarks/c/loops/s3_false-unreach-call.i --full-output --architecture 32bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version aa418289 Calling Ultimate with: java -Dosgi.configuration.area=/tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data/config -Xmx12G -Xms1G -jar /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data -tc /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/config/AutomizerReach.xml -i ../../sv-benchmarks/c/loops/s3_false-unreach-call.i -s /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 32bit --witnessprinter.graph.data.programhash cdf0cf9bd7de1f69825d4535f203da45c4edbbfc ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................. Execution finished normally Using bit-precise analysis Retrying with bit-precise analysis Calling Ultimate with: java -Dosgi.configuration.area=/tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data/config -Xmx12G -Xms1G -jar /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data -tc /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/config/AutomizerReach.xml -i ../../sv-benchmarks/c/loops/s3_false-unreach-call.i -s /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Bitvector.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 32bit --witnessprinter.graph.data.programhash cdf0cf9bd7de1f69825d4535f203da45c4edbbfc ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ Execution finished normally Writing output log to file Ultimate.log Result: TRUE --- Real Ultimate output --- This is Ultimate 0.1.23-aa41828 [2018-11-23 09:54:43,618 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-23 09:54:43,619 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-23 09:54:43,625 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-23 09:54:43,625 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-23 09:54:43,626 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-23 09:54:43,627 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-23 09:54:43,628 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-23 09:54:43,629 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-23 09:54:43,630 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-23 09:54:43,630 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-23 09:54:43,631 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-23 09:54:43,631 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-23 09:54:43,632 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-23 09:54:43,633 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-23 09:54:43,633 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-23 09:54:43,634 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-23 09:54:43,635 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-23 09:54:43,636 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-23 09:54:43,637 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-23 09:54:43,638 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-23 09:54:43,639 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-23 09:54:43,641 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-23 09:54:43,641 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-23 09:54:43,641 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-23 09:54:43,642 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-23 09:54:43,642 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-23 09:54:43,643 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-23 09:54:43,643 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-23 09:54:43,644 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-23 09:54:43,644 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-23 09:54:43,645 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-23 09:54:43,645 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-23 09:54:43,645 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-23 09:54:43,645 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-23 09:54:43,646 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-23 09:54:43,646 INFO L98 SettingsManager]: Beginning loading settings from /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Default.epf [2018-11-23 09:54:43,653 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-23 09:54:43,653 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-23 09:54:43,653 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-23 09:54:43,653 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-23 09:54:43,654 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-23 09:54:43,654 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-23 09:54:43,654 INFO L133 SettingsManager]: * Use SBE=true [2018-11-23 09:54:43,654 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-23 09:54:43,654 INFO L133 SettingsManager]: * sizeof long=4 [2018-11-23 09:54:43,654 INFO L133 SettingsManager]: * Overapproximate operations on floating types=true [2018-11-23 09:54:43,654 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-11-23 09:54:43,654 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-23 09:54:43,654 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-23 09:54:43,654 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * sizeof long double=12 [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-23 09:54:43,655 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 09:54:43,655 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-23 09:54:43,655 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-23 09:54:43,656 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-23 09:54:43,656 INFO L133 SettingsManager]: * Trace refinement strategy=CAMEL [2018-11-23 09:54:43,656 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-23 09:54:43,656 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2018-11-23 09:54:43,656 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 32bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> cdf0cf9bd7de1f69825d4535f203da45c4edbbfc [2018-11-23 09:54:43,679 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-23 09:54:43,688 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-23 09:54:43,691 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-23 09:54:43,692 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-23 09:54:43,692 INFO L276 PluginConnector]: CDTParser initialized [2018-11-23 09:54:43,693 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/../../sv-benchmarks/c/loops/s3_false-unreach-call.i [2018-11-23 09:54:43,731 INFO L221 CDTParser]: Created temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data/aa18e7ae5/07e15559ae6a4ceea54258442fd77097/FLAGc9f7c2f93 [2018-11-23 09:54:44,200 INFO L307 CDTParser]: Found 1 translation units. [2018-11-23 09:54:44,201 INFO L161 CDTParser]: Scanning /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/sv-benchmarks/c/loops/s3_false-unreach-call.i [2018-11-23 09:54:44,212 INFO L355 CDTParser]: About to delete temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data/aa18e7ae5/07e15559ae6a4ceea54258442fd77097/FLAGc9f7c2f93 [2018-11-23 09:54:44,224 INFO L363 CDTParser]: Successfully deleted /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data/aa18e7ae5/07e15559ae6a4ceea54258442fd77097 [2018-11-23 09:54:44,226 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-23 09:54:44,226 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-23 09:54:44,227 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-23 09:54:44,227 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-23 09:54:44,229 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-23 09:54:44,230 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,231 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@43f50e16 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44, skipping insertion in model container [2018-11-23 09:54:44,232 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,237 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-23 09:54:44,275 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-23 09:54:44,542 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 09:54:44,552 INFO L191 MainTranslator]: Completed pre-run [2018-11-23 09:54:44,677 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 09:54:44,693 INFO L195 MainTranslator]: Completed translation [2018-11-23 09:54:44,693 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44 WrapperNode [2018-11-23 09:54:44,693 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-23 09:54:44,694 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-23 09:54:44,694 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-23 09:54:44,694 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-23 09:54:44,702 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,719 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,727 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-23 09:54:44,728 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-23 09:54:44,728 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-23 09:54:44,728 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-23 09:54:44,737 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,737 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,743 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,743 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,777 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,783 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,786 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... [2018-11-23 09:54:44,790 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-23 09:54:44,790 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-23 09:54:44,790 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-23 09:54:44,790 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-23 09:54:44,791 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (1/1) ... No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 09:54:44,840 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-11-23 09:54:44,840 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2018-11-23 09:54:44,840 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-23 09:54:44,840 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-23 09:54:44,841 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2018-11-23 09:54:44,841 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-11-23 09:54:44,842 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2018-11-23 09:54:44,842 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-23 09:54:44,842 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-23 09:54:44,842 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-11-23 09:54:44,842 INFO L130 BoogieDeclarations]: Found specification of procedure ssl3_connect [2018-11-23 09:54:44,842 INFO L138 BoogieDeclarations]: Found implementation of procedure ssl3_connect [2018-11-23 09:54:44,842 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-23 09:54:44,842 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-23 09:54:44,843 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2018-11-23 09:54:45,045 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 09:54:45,045 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 09:54:45,540 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-23 09:54:45,540 INFO L280 CfgBuilder]: Removed 1 assue(true) statements. [2018-11-23 09:54:45,541 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 09:54:45 BoogieIcfgContainer [2018-11-23 09:54:45,541 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-23 09:54:45,542 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-23 09:54:45,542 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-23 09:54:45,544 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-23 09:54:45,545 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 23.11 09:54:44" (1/3) ... [2018-11-23 09:54:45,545 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@2cff03 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 09:54:45, skipping insertion in model container [2018-11-23 09:54:45,545 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:54:44" (2/3) ... [2018-11-23 09:54:45,546 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@2cff03 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 09:54:45, skipping insertion in model container [2018-11-23 09:54:45,546 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 09:54:45" (3/3) ... [2018-11-23 09:54:45,547 INFO L112 eAbstractionObserver]: Analyzing ICFG s3_false-unreach-call.i [2018-11-23 09:54:45,554 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-23 09:54:45,560 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-23 09:54:45,571 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-23 09:54:45,593 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-23 09:54:45,594 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-23 09:54:45,594 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-23 09:54:45,594 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-23 09:54:45,594 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-23 09:54:45,594 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-23 09:54:45,594 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-23 09:54:45,594 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-23 09:54:45,595 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-23 09:54:45,610 INFO L276 IsEmpty]: Start isEmpty. Operand 140 states. [2018-11-23 09:54:45,616 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 31 [2018-11-23 09:54:45,616 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:45,617 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:45,618 INFO L423 AbstractCegarLoop]: === Iteration 1 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:45,622 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:45,622 INFO L82 PathProgramCache]: Analyzing trace with hash -1513562951, now seen corresponding path program 1 times [2018-11-23 09:54:45,623 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:45,624 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:45,659 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:45,660 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:45,660 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:45,729 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:45,822 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 09:54:45,825 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:45,825 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:54:45,828 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:54:45,840 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:54:45,840 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:45,842 INFO L87 Difference]: Start difference. First operand 140 states. Second operand 3 states. [2018-11-23 09:54:45,933 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:45,933 INFO L93 Difference]: Finished difference Result 385 states and 637 transitions. [2018-11-23 09:54:45,933 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:54:45,935 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 30 [2018-11-23 09:54:45,935 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:45,945 INFO L225 Difference]: With dead ends: 385 [2018-11-23 09:54:45,945 INFO L226 Difference]: Without dead ends: 223 [2018-11-23 09:54:45,948 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:45,962 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 223 states. [2018-11-23 09:54:45,987 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 223 to 223. [2018-11-23 09:54:45,988 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 223 states. [2018-11-23 09:54:45,990 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 223 states to 223 states and 327 transitions. [2018-11-23 09:54:45,992 INFO L78 Accepts]: Start accepts. Automaton has 223 states and 327 transitions. Word has length 30 [2018-11-23 09:54:45,992 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:45,992 INFO L480 AbstractCegarLoop]: Abstraction has 223 states and 327 transitions. [2018-11-23 09:54:45,992 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:54:45,993 INFO L276 IsEmpty]: Start isEmpty. Operand 223 states and 327 transitions. [2018-11-23 09:54:45,994 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 46 [2018-11-23 09:54:45,994 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:45,994 INFO L402 BasicCegarLoop]: trace histogram [2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:45,994 INFO L423 AbstractCegarLoop]: === Iteration 2 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:45,995 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:45,995 INFO L82 PathProgramCache]: Analyzing trace with hash -959560751, now seen corresponding path program 1 times [2018-11-23 09:54:45,995 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:45,995 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:45,996 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:45,997 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:45,997 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:46,025 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:46,072 INFO L134 CoverageAnalysis]: Checked inductivity of 8 backedges. 8 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 09:54:46,072 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:46,072 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:54:46,073 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:54:46,073 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:54:46,074 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:46,074 INFO L87 Difference]: Start difference. First operand 223 states and 327 transitions. Second operand 3 states. [2018-11-23 09:54:46,120 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:46,121 INFO L93 Difference]: Finished difference Result 432 states and 642 transitions. [2018-11-23 09:54:46,121 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:54:46,121 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-23 09:54:46,122 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:46,124 INFO L225 Difference]: With dead ends: 432 [2018-11-23 09:54:46,124 INFO L226 Difference]: Without dead ends: 325 [2018-11-23 09:54:46,125 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:46,126 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 325 states. [2018-11-23 09:54:46,140 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 325 to 325. [2018-11-23 09:54:46,141 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 325 states. [2018-11-23 09:54:46,143 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 325 states to 325 states and 476 transitions. [2018-11-23 09:54:46,143 INFO L78 Accepts]: Start accepts. Automaton has 325 states and 476 transitions. Word has length 45 [2018-11-23 09:54:46,143 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:46,143 INFO L480 AbstractCegarLoop]: Abstraction has 325 states and 476 transitions. [2018-11-23 09:54:46,143 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:54:46,144 INFO L276 IsEmpty]: Start isEmpty. Operand 325 states and 476 transitions. [2018-11-23 09:54:46,145 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-23 09:54:46,145 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:46,146 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:46,146 INFO L423 AbstractCegarLoop]: === Iteration 3 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:46,146 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:46,146 INFO L82 PathProgramCache]: Analyzing trace with hash -1822634295, now seen corresponding path program 1 times [2018-11-23 09:54:46,146 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:46,147 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:46,148 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:46,148 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:46,148 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:46,177 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:46,283 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:46,283 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:46,284 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:46,284 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:46,284 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:46,285 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:46,285 INFO L87 Difference]: Start difference. First operand 325 states and 476 transitions. Second operand 4 states. [2018-11-23 09:54:46,710 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:46,710 INFO L93 Difference]: Finished difference Result 825 states and 1216 transitions. [2018-11-23 09:54:46,711 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:46,711 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 63 [2018-11-23 09:54:46,711 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:46,713 INFO L225 Difference]: With dead ends: 825 [2018-11-23 09:54:46,713 INFO L226 Difference]: Without dead ends: 513 [2018-11-23 09:54:46,715 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:46,716 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 513 states. [2018-11-23 09:54:46,733 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 513 to 375. [2018-11-23 09:54:46,733 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 375 states. [2018-11-23 09:54:46,735 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 375 states to 375 states and 562 transitions. [2018-11-23 09:54:46,736 INFO L78 Accepts]: Start accepts. Automaton has 375 states and 562 transitions. Word has length 63 [2018-11-23 09:54:46,736 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:46,736 INFO L480 AbstractCegarLoop]: Abstraction has 375 states and 562 transitions. [2018-11-23 09:54:46,736 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:46,736 INFO L276 IsEmpty]: Start isEmpty. Operand 375 states and 562 transitions. [2018-11-23 09:54:46,738 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-23 09:54:46,738 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:46,738 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:46,738 INFO L423 AbstractCegarLoop]: === Iteration 4 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:46,739 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:46,739 INFO L82 PathProgramCache]: Analyzing trace with hash -1956647801, now seen corresponding path program 1 times [2018-11-23 09:54:46,739 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:46,739 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:46,740 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:46,740 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:46,740 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:46,762 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:46,836 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:46,837 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:46,837 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:46,837 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:46,838 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:46,838 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:46,838 INFO L87 Difference]: Start difference. First operand 375 states and 562 transitions. Second operand 4 states. [2018-11-23 09:54:47,094 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:47,094 INFO L93 Difference]: Finished difference Result 821 states and 1232 transitions. [2018-11-23 09:54:47,094 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:47,095 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 63 [2018-11-23 09:54:47,095 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:47,096 INFO L225 Difference]: With dead ends: 821 [2018-11-23 09:54:47,097 INFO L226 Difference]: Without dead ends: 459 [2018-11-23 09:54:47,098 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:47,098 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 459 states. [2018-11-23 09:54:47,111 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 459 to 415. [2018-11-23 09:54:47,111 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 415 states. [2018-11-23 09:54:47,112 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 415 states to 415 states and 630 transitions. [2018-11-23 09:54:47,113 INFO L78 Accepts]: Start accepts. Automaton has 415 states and 630 transitions. Word has length 63 [2018-11-23 09:54:47,113 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:47,113 INFO L480 AbstractCegarLoop]: Abstraction has 415 states and 630 transitions. [2018-11-23 09:54:47,113 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:47,114 INFO L276 IsEmpty]: Start isEmpty. Operand 415 states and 630 transitions. [2018-11-23 09:54:47,115 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 65 [2018-11-23 09:54:47,116 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:47,116 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:47,116 INFO L423 AbstractCegarLoop]: === Iteration 5 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:47,116 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:47,116 INFO L82 PathProgramCache]: Analyzing trace with hash -671506196, now seen corresponding path program 1 times [2018-11-23 09:54:47,117 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:47,117 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:47,118 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:47,118 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:47,118 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:47,136 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:47,202 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:47,202 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:47,202 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:47,202 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:47,202 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:47,203 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:47,203 INFO L87 Difference]: Start difference. First operand 415 states and 630 transitions. Second operand 4 states. [2018-11-23 09:54:47,507 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:47,507 INFO L93 Difference]: Finished difference Result 949 states and 1429 transitions. [2018-11-23 09:54:47,508 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:47,508 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 64 [2018-11-23 09:54:47,509 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:47,510 INFO L225 Difference]: With dead ends: 949 [2018-11-23 09:54:47,510 INFO L226 Difference]: Without dead ends: 547 [2018-11-23 09:54:47,511 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:47,511 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 547 states. [2018-11-23 09:54:47,519 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 547 to 417. [2018-11-23 09:54:47,519 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 417 states. [2018-11-23 09:54:47,520 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 417 states to 417 states and 632 transitions. [2018-11-23 09:54:47,520 INFO L78 Accepts]: Start accepts. Automaton has 417 states and 632 transitions. Word has length 64 [2018-11-23 09:54:47,521 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:47,521 INFO L480 AbstractCegarLoop]: Abstraction has 417 states and 632 transitions. [2018-11-23 09:54:47,521 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:47,521 INFO L276 IsEmpty]: Start isEmpty. Operand 417 states and 632 transitions. [2018-11-23 09:54:47,522 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 66 [2018-11-23 09:54:47,522 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:47,522 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:47,522 INFO L423 AbstractCegarLoop]: === Iteration 6 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:47,522 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:47,522 INFO L82 PathProgramCache]: Analyzing trace with hash 653887364, now seen corresponding path program 1 times [2018-11-23 09:54:47,523 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:47,523 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:47,523 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:47,524 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:47,524 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:47,538 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:47,579 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:47,579 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:47,579 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:47,580 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:47,580 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:47,580 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:47,580 INFO L87 Difference]: Start difference. First operand 417 states and 632 transitions. Second operand 4 states. [2018-11-23 09:54:47,836 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:47,836 INFO L93 Difference]: Finished difference Result 951 states and 1429 transitions. [2018-11-23 09:54:47,837 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:47,837 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 65 [2018-11-23 09:54:47,837 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:47,838 INFO L225 Difference]: With dead ends: 951 [2018-11-23 09:54:47,838 INFO L226 Difference]: Without dead ends: 547 [2018-11-23 09:54:47,839 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:47,840 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 547 states. [2018-11-23 09:54:47,847 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 547 to 419. [2018-11-23 09:54:47,847 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 419 states. [2018-11-23 09:54:47,848 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 419 states to 419 states and 634 transitions. [2018-11-23 09:54:47,848 INFO L78 Accepts]: Start accepts. Automaton has 419 states and 634 transitions. Word has length 65 [2018-11-23 09:54:47,849 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:47,849 INFO L480 AbstractCegarLoop]: Abstraction has 419 states and 634 transitions. [2018-11-23 09:54:47,849 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:47,849 INFO L276 IsEmpty]: Start isEmpty. Operand 419 states and 634 transitions. [2018-11-23 09:54:47,850 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 67 [2018-11-23 09:54:47,850 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:47,850 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:47,850 INFO L423 AbstractCegarLoop]: === Iteration 7 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:47,851 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:47,851 INFO L82 PathProgramCache]: Analyzing trace with hash -1208805305, now seen corresponding path program 1 times [2018-11-23 09:54:47,851 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:47,851 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:47,852 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:47,852 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:47,852 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:47,867 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:47,905 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:47,905 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:47,905 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:47,905 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:47,906 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:47,906 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:47,906 INFO L87 Difference]: Start difference. First operand 419 states and 634 transitions. Second operand 4 states. [2018-11-23 09:54:48,152 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:48,152 INFO L93 Difference]: Finished difference Result 943 states and 1417 transitions. [2018-11-23 09:54:48,153 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:48,153 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 66 [2018-11-23 09:54:48,153 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:48,154 INFO L225 Difference]: With dead ends: 943 [2018-11-23 09:54:48,154 INFO L226 Difference]: Without dead ends: 537 [2018-11-23 09:54:48,155 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:48,156 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 537 states. [2018-11-23 09:54:48,162 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 537 to 421. [2018-11-23 09:54:48,163 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:48,164 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 636 transitions. [2018-11-23 09:54:48,164 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 636 transitions. Word has length 66 [2018-11-23 09:54:48,164 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:48,164 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 636 transitions. [2018-11-23 09:54:48,164 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:48,164 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 636 transitions. [2018-11-23 09:54:48,165 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 09:54:48,165 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:48,166 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:48,166 INFO L423 AbstractCegarLoop]: === Iteration 8 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:48,166 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:48,166 INFO L82 PathProgramCache]: Analyzing trace with hash -784316286, now seen corresponding path program 1 times [2018-11-23 09:54:48,166 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:48,166 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:48,167 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:48,167 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:48,167 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:48,179 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:48,226 INFO L134 CoverageAnalysis]: Checked inductivity of 44 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:48,227 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:48,227 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:48,227 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:48,227 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:48,227 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:48,228 INFO L87 Difference]: Start difference. First operand 421 states and 636 transitions. Second operand 4 states. [2018-11-23 09:54:48,459 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:48,459 INFO L93 Difference]: Finished difference Result 943 states and 1415 transitions. [2018-11-23 09:54:48,460 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:48,460 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 09:54:48,460 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:48,462 INFO L225 Difference]: With dead ends: 943 [2018-11-23 09:54:48,462 INFO L226 Difference]: Without dead ends: 535 [2018-11-23 09:54:48,463 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:48,463 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 535 states. [2018-11-23 09:54:48,470 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 535 to 421. [2018-11-23 09:54:48,470 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:48,471 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 634 transitions. [2018-11-23 09:54:48,472 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 634 transitions. Word has length 78 [2018-11-23 09:54:48,472 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:48,472 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 634 transitions. [2018-11-23 09:54:48,472 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:48,472 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 634 transitions. [2018-11-23 09:54:48,473 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 09:54:48,473 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:48,473 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:48,473 INFO L423 AbstractCegarLoop]: === Iteration 9 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:48,474 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:48,474 INFO L82 PathProgramCache]: Analyzing trace with hash -802971744, now seen corresponding path program 1 times [2018-11-23 09:54:48,474 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:48,474 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:48,475 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:48,475 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:48,475 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:48,487 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:48,525 INFO L134 CoverageAnalysis]: Checked inductivity of 47 backedges. 39 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:48,525 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:48,525 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:48,525 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:48,525 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:48,526 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:48,526 INFO L87 Difference]: Start difference. First operand 421 states and 634 transitions. Second operand 4 states. [2018-11-23 09:54:48,770 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:48,770 INFO L93 Difference]: Finished difference Result 943 states and 1411 transitions. [2018-11-23 09:54:48,770 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:48,770 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 09:54:48,771 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:48,772 INFO L225 Difference]: With dead ends: 943 [2018-11-23 09:54:48,772 INFO L226 Difference]: Without dead ends: 535 [2018-11-23 09:54:48,772 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:48,773 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 535 states. [2018-11-23 09:54:48,780 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 535 to 421. [2018-11-23 09:54:48,780 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:48,781 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 632 transitions. [2018-11-23 09:54:48,781 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 632 transitions. Word has length 78 [2018-11-23 09:54:48,782 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:48,782 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 632 transitions. [2018-11-23 09:54:48,782 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:48,782 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 632 transitions. [2018-11-23 09:54:48,783 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 09:54:48,783 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:48,783 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:48,783 INFO L423 AbstractCegarLoop]: === Iteration 10 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:48,783 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:48,783 INFO L82 PathProgramCache]: Analyzing trace with hash -1508472381, now seen corresponding path program 1 times [2018-11-23 09:54:48,783 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:48,783 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:48,784 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:48,784 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:48,784 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:48,794 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:48,839 INFO L134 CoverageAnalysis]: Checked inductivity of 63 backedges. 55 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:48,839 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:48,839 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:48,840 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:48,840 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:48,840 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:48,840 INFO L87 Difference]: Start difference. First operand 421 states and 632 transitions. Second operand 4 states. [2018-11-23 09:54:49,091 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:49,091 INFO L93 Difference]: Finished difference Result 794 states and 1181 transitions. [2018-11-23 09:54:49,097 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:49,097 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 09:54:49,097 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:49,099 INFO L225 Difference]: With dead ends: 794 [2018-11-23 09:54:49,099 INFO L226 Difference]: Without dead ends: 535 [2018-11-23 09:54:49,100 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:49,100 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 535 states. [2018-11-23 09:54:49,110 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 535 to 421. [2018-11-23 09:54:49,110 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:49,112 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 630 transitions. [2018-11-23 09:54:49,112 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 630 transitions. Word has length 78 [2018-11-23 09:54:49,113 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:49,113 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 630 transitions. [2018-11-23 09:54:49,113 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:49,113 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 630 transitions. [2018-11-23 09:54:49,114 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 09:54:49,115 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:49,115 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:49,115 INFO L423 AbstractCegarLoop]: === Iteration 11 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:49,115 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:49,115 INFO L82 PathProgramCache]: Analyzing trace with hash 1665283844, now seen corresponding path program 1 times [2018-11-23 09:54:49,115 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:49,116 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:49,116 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:49,117 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:49,117 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:49,130 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:49,171 INFO L134 CoverageAnalysis]: Checked inductivity of 44 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:49,172 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:49,172 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:49,172 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:49,172 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:49,173 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:49,173 INFO L87 Difference]: Start difference. First operand 421 states and 630 transitions. Second operand 4 states. [2018-11-23 09:54:49,365 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:49,365 INFO L93 Difference]: Finished difference Result 871 states and 1296 transitions. [2018-11-23 09:54:49,366 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:49,366 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 09:54:49,366 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:49,367 INFO L225 Difference]: With dead ends: 871 [2018-11-23 09:54:49,367 INFO L226 Difference]: Without dead ends: 463 [2018-11-23 09:54:49,368 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:49,369 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 463 states. [2018-11-23 09:54:49,376 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 463 to 421. [2018-11-23 09:54:49,376 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:49,377 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 628 transitions. [2018-11-23 09:54:49,377 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 628 transitions. Word has length 78 [2018-11-23 09:54:49,377 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:49,377 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 628 transitions. [2018-11-23 09:54:49,377 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:49,377 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 628 transitions. [2018-11-23 09:54:49,378 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 09:54:49,378 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:49,378 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:49,379 INFO L423 AbstractCegarLoop]: === Iteration 12 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:49,379 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:49,379 INFO L82 PathProgramCache]: Analyzing trace with hash 1646628386, now seen corresponding path program 1 times [2018-11-23 09:54:49,379 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:49,379 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:49,380 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:49,380 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:49,380 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:49,390 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:49,433 INFO L134 CoverageAnalysis]: Checked inductivity of 47 backedges. 39 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:49,433 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:49,433 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:49,433 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:49,433 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:49,434 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:49,434 INFO L87 Difference]: Start difference. First operand 421 states and 628 transitions. Second operand 4 states. [2018-11-23 09:54:49,595 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:49,595 INFO L93 Difference]: Finished difference Result 871 states and 1292 transitions. [2018-11-23 09:54:49,595 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:49,595 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 09:54:49,596 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:49,596 INFO L225 Difference]: With dead ends: 871 [2018-11-23 09:54:49,597 INFO L226 Difference]: Without dead ends: 463 [2018-11-23 09:54:49,597 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:49,598 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 463 states. [2018-11-23 09:54:49,604 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 463 to 421. [2018-11-23 09:54:49,605 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:49,606 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 626 transitions. [2018-11-23 09:54:49,606 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 626 transitions. Word has length 78 [2018-11-23 09:54:49,606 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:49,606 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 626 transitions. [2018-11-23 09:54:49,606 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:49,606 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 626 transitions. [2018-11-23 09:54:49,607 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 09:54:49,607 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:49,607 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:49,607 INFO L423 AbstractCegarLoop]: === Iteration 13 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:49,607 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:49,608 INFO L82 PathProgramCache]: Analyzing trace with hash 941127749, now seen corresponding path program 1 times [2018-11-23 09:54:49,608 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:49,608 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:49,609 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:49,609 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:49,609 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:49,618 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:49,644 INFO L134 CoverageAnalysis]: Checked inductivity of 63 backedges. 55 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:49,644 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:49,644 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:49,645 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:49,645 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:49,645 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:49,645 INFO L87 Difference]: Start difference. First operand 421 states and 626 transitions. Second operand 4 states. [2018-11-23 09:54:49,801 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:49,801 INFO L93 Difference]: Finished difference Result 722 states and 1065 transitions. [2018-11-23 09:54:49,802 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:49,802 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 09:54:49,802 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:49,803 INFO L225 Difference]: With dead ends: 722 [2018-11-23 09:54:49,803 INFO L226 Difference]: Without dead ends: 463 [2018-11-23 09:54:49,803 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:49,804 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 463 states. [2018-11-23 09:54:49,811 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 463 to 421. [2018-11-23 09:54:49,811 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:49,812 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 624 transitions. [2018-11-23 09:54:49,812 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 624 transitions. Word has length 78 [2018-11-23 09:54:49,812 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:49,813 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 624 transitions. [2018-11-23 09:54:49,813 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:49,813 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 624 transitions. [2018-11-23 09:54:49,814 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-23 09:54:49,814 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:49,814 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:49,814 INFO L423 AbstractCegarLoop]: === Iteration 14 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:49,814 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:49,814 INFO L82 PathProgramCache]: Analyzing trace with hash -1290131619, now seen corresponding path program 1 times [2018-11-23 09:54:49,814 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:49,814 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:49,815 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:49,815 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:49,815 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:49,823 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:49,849 INFO L134 CoverageAnalysis]: Checked inductivity of 50 backedges. 42 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:49,850 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:49,850 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:49,850 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:49,850 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:49,850 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:49,850 INFO L87 Difference]: Start difference. First operand 421 states and 624 transitions. Second operand 4 states. [2018-11-23 09:54:50,087 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:50,087 INFO L93 Difference]: Finished difference Result 943 states and 1391 transitions. [2018-11-23 09:54:50,087 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:50,088 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-23 09:54:50,088 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:50,089 INFO L225 Difference]: With dead ends: 943 [2018-11-23 09:54:50,089 INFO L226 Difference]: Without dead ends: 535 [2018-11-23 09:54:50,090 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:50,090 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 535 states. [2018-11-23 09:54:50,098 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 535 to 421. [2018-11-23 09:54:50,098 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:50,099 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 622 transitions. [2018-11-23 09:54:50,099 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 622 transitions. Word has length 79 [2018-11-23 09:54:50,099 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:50,099 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 622 transitions. [2018-11-23 09:54:50,099 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:50,099 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 622 transitions. [2018-11-23 09:54:50,100 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-23 09:54:50,100 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:50,100 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:50,101 INFO L423 AbstractCegarLoop]: === Iteration 15 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:50,101 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:50,101 INFO L82 PathProgramCache]: Analyzing trace with hash 765876928, now seen corresponding path program 1 times [2018-11-23 09:54:50,101 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:50,101 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:50,102 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:50,102 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:50,102 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:50,110 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:50,136 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 57 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:50,136 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:50,136 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:50,137 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:50,137 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:50,137 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:50,137 INFO L87 Difference]: Start difference. First operand 421 states and 622 transitions. Second operand 4 states. [2018-11-23 09:54:50,363 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:50,364 INFO L93 Difference]: Finished difference Result 788 states and 1159 transitions. [2018-11-23 09:54:50,364 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:50,364 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-23 09:54:50,364 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:50,366 INFO L225 Difference]: With dead ends: 788 [2018-11-23 09:54:50,366 INFO L226 Difference]: Without dead ends: 529 [2018-11-23 09:54:50,366 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:50,367 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 529 states. [2018-11-23 09:54:50,375 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 529 to 421. [2018-11-23 09:54:50,375 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:50,376 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 620 transitions. [2018-11-23 09:54:50,376 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 620 transitions. Word has length 79 [2018-11-23 09:54:50,376 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:50,376 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 620 transitions. [2018-11-23 09:54:50,376 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:50,377 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 620 transitions. [2018-11-23 09:54:50,377 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-23 09:54:50,377 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:50,378 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:50,378 INFO L423 AbstractCegarLoop]: === Iteration 16 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:50,378 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:50,378 INFO L82 PathProgramCache]: Analyzing trace with hash 1633028379, now seen corresponding path program 1 times [2018-11-23 09:54:50,378 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:50,378 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:50,379 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:50,379 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:50,379 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:50,387 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:50,412 INFO L134 CoverageAnalysis]: Checked inductivity of 50 backedges. 42 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:50,412 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:50,412 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:50,412 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:50,412 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:50,412 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:50,413 INFO L87 Difference]: Start difference. First operand 421 states and 620 transitions. Second operand 4 states. [2018-11-23 09:54:50,581 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:50,581 INFO L93 Difference]: Finished difference Result 871 states and 1276 transitions. [2018-11-23 09:54:50,582 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:50,582 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-23 09:54:50,582 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:50,583 INFO L225 Difference]: With dead ends: 871 [2018-11-23 09:54:50,583 INFO L226 Difference]: Without dead ends: 463 [2018-11-23 09:54:50,584 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:50,584 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 463 states. [2018-11-23 09:54:50,591 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 463 to 421. [2018-11-23 09:54:50,591 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:50,592 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 618 transitions. [2018-11-23 09:54:50,592 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 618 transitions. Word has length 79 [2018-11-23 09:54:50,593 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:50,593 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 618 transitions. [2018-11-23 09:54:50,593 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:50,593 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 618 transitions. [2018-11-23 09:54:50,594 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-23 09:54:50,594 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:50,594 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:50,594 INFO L423 AbstractCegarLoop]: === Iteration 17 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:50,594 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:50,594 INFO L82 PathProgramCache]: Analyzing trace with hash -605930370, now seen corresponding path program 1 times [2018-11-23 09:54:50,594 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:50,594 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:50,595 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:50,595 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:50,595 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:50,604 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:50,628 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 57 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:50,628 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:50,628 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:50,629 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:50,629 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:50,629 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:50,629 INFO L87 Difference]: Start difference. First operand 421 states and 618 transitions. Second operand 4 states. [2018-11-23 09:54:50,795 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:50,795 INFO L93 Difference]: Finished difference Result 716 states and 1046 transitions. [2018-11-23 09:54:50,796 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:50,796 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-23 09:54:50,796 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:50,797 INFO L225 Difference]: With dead ends: 716 [2018-11-23 09:54:50,797 INFO L226 Difference]: Without dead ends: 457 [2018-11-23 09:54:50,798 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:50,799 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 457 states. [2018-11-23 09:54:50,808 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 457 to 421. [2018-11-23 09:54:50,808 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:50,809 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 616 transitions. [2018-11-23 09:54:50,809 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 616 transitions. Word has length 79 [2018-11-23 09:54:50,809 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:50,809 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 616 transitions. [2018-11-23 09:54:50,809 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:50,810 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 616 transitions. [2018-11-23 09:54:50,811 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 81 [2018-11-23 09:54:50,811 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:50,811 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:50,811 INFO L423 AbstractCegarLoop]: === Iteration 18 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:50,811 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:50,811 INFO L82 PathProgramCache]: Analyzing trace with hash -1753186171, now seen corresponding path program 1 times [2018-11-23 09:54:50,812 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:50,812 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:50,812 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:50,813 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:50,813 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:50,823 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:50,853 INFO L134 CoverageAnalysis]: Checked inductivity of 53 backedges. 45 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:50,854 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:50,854 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:50,854 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:50,854 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:50,854 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:50,855 INFO L87 Difference]: Start difference. First operand 421 states and 616 transitions. Second operand 4 states. [2018-11-23 09:54:51,110 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:51,110 INFO L93 Difference]: Finished difference Result 937 states and 1368 transitions. [2018-11-23 09:54:51,111 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:51,111 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 80 [2018-11-23 09:54:51,111 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:51,112 INFO L225 Difference]: With dead ends: 937 [2018-11-23 09:54:51,112 INFO L226 Difference]: Without dead ends: 529 [2018-11-23 09:54:51,113 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:51,113 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 529 states. [2018-11-23 09:54:51,121 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 529 to 421. [2018-11-23 09:54:51,121 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:51,122 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 614 transitions. [2018-11-23 09:54:51,122 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 614 transitions. Word has length 80 [2018-11-23 09:54:51,122 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:51,122 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 614 transitions. [2018-11-23 09:54:51,122 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:51,123 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 614 transitions. [2018-11-23 09:54:51,124 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 81 [2018-11-23 09:54:51,124 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:51,124 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:51,124 INFO L423 AbstractCegarLoop]: === Iteration 19 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:51,124 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:51,124 INFO L82 PathProgramCache]: Analyzing trace with hash -1329539449, now seen corresponding path program 1 times [2018-11-23 09:54:51,124 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:51,124 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:51,125 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:51,125 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:51,125 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:51,134 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:51,160 INFO L134 CoverageAnalysis]: Checked inductivity of 53 backedges. 45 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:51,160 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:51,160 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:51,160 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:51,161 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:51,161 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:51,161 INFO L87 Difference]: Start difference. First operand 421 states and 614 transitions. Second operand 4 states. [2018-11-23 09:54:51,319 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:51,319 INFO L93 Difference]: Finished difference Result 865 states and 1257 transitions. [2018-11-23 09:54:51,320 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:51,320 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 80 [2018-11-23 09:54:51,320 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:51,322 INFO L225 Difference]: With dead ends: 865 [2018-11-23 09:54:51,322 INFO L226 Difference]: Without dead ends: 457 [2018-11-23 09:54:51,323 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:51,323 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 457 states. [2018-11-23 09:54:51,335 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 457 to 421. [2018-11-23 09:54:51,335 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:51,337 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 612 transitions. [2018-11-23 09:54:51,337 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 612 transitions. Word has length 80 [2018-11-23 09:54:51,337 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:51,337 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 612 transitions. [2018-11-23 09:54:51,337 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:51,337 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 612 transitions. [2018-11-23 09:54:51,338 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-23 09:54:51,338 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:51,338 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:51,339 INFO L423 AbstractCegarLoop]: === Iteration 20 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:51,339 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:51,339 INFO L82 PathProgramCache]: Analyzing trace with hash -1468975710, now seen corresponding path program 1 times [2018-11-23 09:54:51,339 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:51,339 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:51,340 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:51,340 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:51,340 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:51,351 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:51,393 INFO L134 CoverageAnalysis]: Checked inductivity of 56 backedges. 48 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:51,394 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:51,394 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:51,394 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:51,394 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:51,394 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:51,395 INFO L87 Difference]: Start difference. First operand 421 states and 612 transitions. Second operand 4 states. [2018-11-23 09:54:51,603 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:51,603 INFO L93 Difference]: Finished difference Result 919 states and 1338 transitions. [2018-11-23 09:54:51,604 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:51,604 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 81 [2018-11-23 09:54:51,604 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:51,605 INFO L225 Difference]: With dead ends: 919 [2018-11-23 09:54:51,605 INFO L226 Difference]: Without dead ends: 511 [2018-11-23 09:54:51,606 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:51,607 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 511 states. [2018-11-23 09:54:51,614 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 511 to 421. [2018-11-23 09:54:51,614 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:51,615 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 610 transitions. [2018-11-23 09:54:51,615 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 610 transitions. Word has length 81 [2018-11-23 09:54:51,616 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:51,616 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 610 transitions. [2018-11-23 09:54:51,616 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:51,616 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 610 transitions. [2018-11-23 09:54:51,617 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-23 09:54:51,617 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:51,617 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:51,617 INFO L423 AbstractCegarLoop]: === Iteration 21 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:51,617 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:51,618 INFO L82 PathProgramCache]: Analyzing trace with hash 1134564595, now seen corresponding path program 1 times [2018-11-23 09:54:51,618 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:51,618 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:51,619 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:51,619 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:51,619 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:51,627 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:51,649 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 57 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:51,649 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:51,649 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:51,649 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:51,650 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:51,650 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:51,650 INFO L87 Difference]: Start difference. First operand 421 states and 610 transitions. Second operand 4 states. [2018-11-23 09:54:51,863 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:51,863 INFO L93 Difference]: Finished difference Result 919 states and 1334 transitions. [2018-11-23 09:54:51,863 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:51,863 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 81 [2018-11-23 09:54:51,864 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:51,865 INFO L225 Difference]: With dead ends: 919 [2018-11-23 09:54:51,865 INFO L226 Difference]: Without dead ends: 511 [2018-11-23 09:54:51,866 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:51,866 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 511 states. [2018-11-23 09:54:51,874 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 511 to 421. [2018-11-23 09:54:51,874 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:51,875 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 608 transitions. [2018-11-23 09:54:51,875 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 608 transitions. Word has length 81 [2018-11-23 09:54:51,875 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:51,875 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 608 transitions. [2018-11-23 09:54:51,875 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:51,875 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 608 transitions. [2018-11-23 09:54:51,876 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-23 09:54:51,876 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:51,876 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:51,877 INFO L423 AbstractCegarLoop]: === Iteration 22 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:51,877 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:51,877 INFO L82 PathProgramCache]: Analyzing trace with hash -1220829216, now seen corresponding path program 1 times [2018-11-23 09:54:51,877 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:51,877 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:51,878 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:51,878 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:51,878 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:51,886 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:51,911 INFO L134 CoverageAnalysis]: Checked inductivity of 56 backedges. 48 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:54:51,911 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:51,911 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:51,911 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:51,911 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:51,911 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:51,912 INFO L87 Difference]: Start difference. First operand 421 states and 608 transitions. Second operand 4 states. [2018-11-23 09:54:52,055 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:52,055 INFO L93 Difference]: Finished difference Result 847 states and 1223 transitions. [2018-11-23 09:54:52,057 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:52,057 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 81 [2018-11-23 09:54:52,057 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:52,058 INFO L225 Difference]: With dead ends: 847 [2018-11-23 09:54:52,059 INFO L226 Difference]: Without dead ends: 439 [2018-11-23 09:54:52,059 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:52,060 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 439 states. [2018-11-23 09:54:52,071 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 439 to 421. [2018-11-23 09:54:52,071 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 09:54:52,072 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 606 transitions. [2018-11-23 09:54:52,073 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 606 transitions. Word has length 81 [2018-11-23 09:54:52,073 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:52,073 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 606 transitions. [2018-11-23 09:54:52,073 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:52,073 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 606 transitions. [2018-11-23 09:54:52,074 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-23 09:54:52,074 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:52,074 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:52,074 INFO L423 AbstractCegarLoop]: === Iteration 23 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:52,074 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:52,075 INFO L82 PathProgramCache]: Analyzing trace with hash 1382711089, now seen corresponding path program 1 times [2018-11-23 09:54:52,075 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:52,075 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:52,075 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,075 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:52,076 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,088 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:52,114 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 42 proven. 0 refuted. 0 times theorem prover too weak. 23 trivial. 0 not checked. [2018-11-23 09:54:52,114 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:52,114 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:54:52,114 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:54:52,114 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:54:52,114 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:52,115 INFO L87 Difference]: Start difference. First operand 421 states and 606 transitions. Second operand 3 states. [2018-11-23 09:54:52,147 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:52,147 INFO L93 Difference]: Finished difference Result 831 states and 1204 transitions. [2018-11-23 09:54:52,148 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:54:52,148 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 81 [2018-11-23 09:54:52,148 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:52,150 INFO L225 Difference]: With dead ends: 831 [2018-11-23 09:54:52,150 INFO L226 Difference]: Without dead ends: 574 [2018-11-23 09:54:52,151 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:52,151 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 574 states. [2018-11-23 09:54:52,165 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 574 to 574. [2018-11-23 09:54:52,165 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 574 states. [2018-11-23 09:54:52,166 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 574 states to 574 states and 827 transitions. [2018-11-23 09:54:52,167 INFO L78 Accepts]: Start accepts. Automaton has 574 states and 827 transitions. Word has length 81 [2018-11-23 09:54:52,167 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:52,167 INFO L480 AbstractCegarLoop]: Abstraction has 574 states and 827 transitions. [2018-11-23 09:54:52,167 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:54:52,167 INFO L276 IsEmpty]: Start isEmpty. Operand 574 states and 827 transitions. [2018-11-23 09:54:52,168 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 84 [2018-11-23 09:54:52,168 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:52,168 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:52,168 INFO L423 AbstractCegarLoop]: === Iteration 24 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:52,168 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:52,168 INFO L82 PathProgramCache]: Analyzing trace with hash 1024261319, now seen corresponding path program 1 times [2018-11-23 09:54:52,172 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:52,172 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:52,172 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,173 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:52,173 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,184 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:52,206 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 29 trivial. 0 not checked. [2018-11-23 09:54:52,206 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:52,206 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:54:52,206 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:54:52,206 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:54:52,206 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:52,207 INFO L87 Difference]: Start difference. First operand 574 states and 827 transitions. Second operand 3 states. [2018-11-23 09:54:52,249 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:52,249 INFO L93 Difference]: Finished difference Result 729 states and 1052 transitions. [2018-11-23 09:54:52,249 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:54:52,250 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 83 [2018-11-23 09:54:52,250 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:52,252 INFO L225 Difference]: With dead ends: 729 [2018-11-23 09:54:52,253 INFO L226 Difference]: Without dead ends: 727 [2018-11-23 09:54:52,253 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:52,254 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 727 states. [2018-11-23 09:54:52,269 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 727 to 727. [2018-11-23 09:54:52,270 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 727 states. [2018-11-23 09:54:52,271 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 727 states to 727 states and 1049 transitions. [2018-11-23 09:54:52,271 INFO L78 Accepts]: Start accepts. Automaton has 727 states and 1049 transitions. Word has length 83 [2018-11-23 09:54:52,272 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:52,272 INFO L480 AbstractCegarLoop]: Abstraction has 727 states and 1049 transitions. [2018-11-23 09:54:52,272 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:54:52,272 INFO L276 IsEmpty]: Start isEmpty. Operand 727 states and 1049 transitions. [2018-11-23 09:54:52,275 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 105 [2018-11-23 09:54:52,275 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:52,275 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:52,275 INFO L423 AbstractCegarLoop]: === Iteration 25 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:52,276 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:52,276 INFO L82 PathProgramCache]: Analyzing trace with hash 934069236, now seen corresponding path program 1 times [2018-11-23 09:54:52,276 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:52,276 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:52,277 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,277 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:52,277 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,290 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:52,315 INFO L134 CoverageAnalysis]: Checked inductivity of 118 backedges. 53 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 09:54:52,315 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:52,316 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:54:52,316 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:54:52,316 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:54:52,316 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:52,316 INFO L87 Difference]: Start difference. First operand 727 states and 1049 transitions. Second operand 3 states. [2018-11-23 09:54:52,368 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:52,368 INFO L93 Difference]: Finished difference Result 1287 states and 1862 transitions. [2018-11-23 09:54:52,373 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:54:52,373 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 104 [2018-11-23 09:54:52,373 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:52,375 INFO L225 Difference]: With dead ends: 1287 [2018-11-23 09:54:52,375 INFO L226 Difference]: Without dead ends: 724 [2018-11-23 09:54:52,376 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:54:52,377 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 724 states. [2018-11-23 09:54:52,391 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 724 to 724. [2018-11-23 09:54:52,391 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 724 states. [2018-11-23 09:54:52,393 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 724 states to 724 states and 1039 transitions. [2018-11-23 09:54:52,393 INFO L78 Accepts]: Start accepts. Automaton has 724 states and 1039 transitions. Word has length 104 [2018-11-23 09:54:52,393 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:52,393 INFO L480 AbstractCegarLoop]: Abstraction has 724 states and 1039 transitions. [2018-11-23 09:54:52,393 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:54:52,393 INFO L276 IsEmpty]: Start isEmpty. Operand 724 states and 1039 transitions. [2018-11-23 09:54:52,395 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 107 [2018-11-23 09:54:52,395 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:52,395 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:52,395 INFO L423 AbstractCegarLoop]: === Iteration 26 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:52,395 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:52,395 INFO L82 PathProgramCache]: Analyzing trace with hash -148840977, now seen corresponding path program 1 times [2018-11-23 09:54:52,396 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:52,396 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:52,396 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,396 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:52,396 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,410 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:52,449 INFO L134 CoverageAnalysis]: Checked inductivity of 118 backedges. 53 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 09:54:52,449 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:52,450 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:52,450 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:52,450 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:52,450 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:52,450 INFO L87 Difference]: Start difference. First operand 724 states and 1039 transitions. Second operand 4 states. [2018-11-23 09:54:52,674 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:52,675 INFO L93 Difference]: Finished difference Result 1692 states and 2439 transitions. [2018-11-23 09:54:52,675 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:52,675 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 106 [2018-11-23 09:54:52,676 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:52,677 INFO L225 Difference]: With dead ends: 1692 [2018-11-23 09:54:52,678 INFO L226 Difference]: Without dead ends: 981 [2018-11-23 09:54:52,678 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:52,679 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 981 states. [2018-11-23 09:54:52,691 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 981 to 844. [2018-11-23 09:54:52,691 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 844 states. [2018-11-23 09:54:52,692 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 844 states to 844 states and 1249 transitions. [2018-11-23 09:54:52,692 INFO L78 Accepts]: Start accepts. Automaton has 844 states and 1249 transitions. Word has length 106 [2018-11-23 09:54:52,692 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:52,692 INFO L480 AbstractCegarLoop]: Abstraction has 844 states and 1249 transitions. [2018-11-23 09:54:52,692 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:52,692 INFO L276 IsEmpty]: Start isEmpty. Operand 844 states and 1249 transitions. [2018-11-23 09:54:52,694 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 122 [2018-11-23 09:54:52,694 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:52,694 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:52,694 INFO L423 AbstractCegarLoop]: === Iteration 27 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:52,694 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:52,695 INFO L82 PathProgramCache]: Analyzing trace with hash -1084285646, now seen corresponding path program 1 times [2018-11-23 09:54:52,695 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:52,695 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:52,695 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,695 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:52,696 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,708 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:52,756 INFO L134 CoverageAnalysis]: Checked inductivity of 145 backedges. 80 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 09:54:52,756 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:52,756 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:52,756 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:52,757 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:52,757 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:52,757 INFO L87 Difference]: Start difference. First operand 844 states and 1249 transitions. Second operand 4 states. [2018-11-23 09:54:52,914 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:52,915 INFO L93 Difference]: Finished difference Result 1807 states and 2639 transitions. [2018-11-23 09:54:52,916 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:52,916 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 121 [2018-11-23 09:54:52,916 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:52,918 INFO L225 Difference]: With dead ends: 1807 [2018-11-23 09:54:52,918 INFO L226 Difference]: Without dead ends: 976 [2018-11-23 09:54:52,919 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:52,920 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 976 states. [2018-11-23 09:54:52,932 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 976 to 844. [2018-11-23 09:54:52,932 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 844 states. [2018-11-23 09:54:52,933 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 844 states to 844 states and 1244 transitions. [2018-11-23 09:54:52,933 INFO L78 Accepts]: Start accepts. Automaton has 844 states and 1244 transitions. Word has length 121 [2018-11-23 09:54:52,933 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:52,933 INFO L480 AbstractCegarLoop]: Abstraction has 844 states and 1244 transitions. [2018-11-23 09:54:52,934 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:52,934 INFO L276 IsEmpty]: Start isEmpty. Operand 844 states and 1244 transitions. [2018-11-23 09:54:52,935 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 122 [2018-11-23 09:54:52,935 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:52,936 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:52,936 INFO L423 AbstractCegarLoop]: === Iteration 28 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:52,936 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:52,936 INFO L82 PathProgramCache]: Analyzing trace with hash -1832311600, now seen corresponding path program 1 times [2018-11-23 09:54:52,936 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:52,936 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:52,937 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,937 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:52,937 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:52,949 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:52,979 INFO L134 CoverageAnalysis]: Checked inductivity of 150 backedges. 85 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 09:54:52,979 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:52,979 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:52,980 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:52,980 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:52,980 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:52,980 INFO L87 Difference]: Start difference. First operand 844 states and 1244 transitions. Second operand 4 states. [2018-11-23 09:54:53,141 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:53,141 INFO L93 Difference]: Finished difference Result 1807 states and 2629 transitions. [2018-11-23 09:54:53,142 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:53,142 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 121 [2018-11-23 09:54:53,142 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:53,144 INFO L225 Difference]: With dead ends: 1807 [2018-11-23 09:54:53,144 INFO L226 Difference]: Without dead ends: 976 [2018-11-23 09:54:53,145 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:53,146 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 976 states. [2018-11-23 09:54:53,157 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 976 to 844. [2018-11-23 09:54:53,158 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 844 states. [2018-11-23 09:54:53,159 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 844 states to 844 states and 1239 transitions. [2018-11-23 09:54:53,159 INFO L78 Accepts]: Start accepts. Automaton has 844 states and 1239 transitions. Word has length 121 [2018-11-23 09:54:53,159 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:53,159 INFO L480 AbstractCegarLoop]: Abstraction has 844 states and 1239 transitions. [2018-11-23 09:54:53,159 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:53,159 INFO L276 IsEmpty]: Start isEmpty. Operand 844 states and 1239 transitions. [2018-11-23 09:54:53,161 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 122 [2018-11-23 09:54:53,161 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:53,161 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 6, 6, 5, 5, 5, 4, 4, 3, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:53,161 INFO L423 AbstractCegarLoop]: === Iteration 29 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:53,161 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:53,161 INFO L82 PathProgramCache]: Analyzing trace with hash -1213590989, now seen corresponding path program 1 times [2018-11-23 09:54:53,161 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:53,162 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:53,162 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:53,162 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:53,162 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:53,175 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:53,215 INFO L134 CoverageAnalysis]: Checked inductivity of 174 backedges. 65 proven. 0 refuted. 0 times theorem prover too weak. 109 trivial. 0 not checked. [2018-11-23 09:54:53,215 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:53,215 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:53,216 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:53,216 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:53,216 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:53,216 INFO L87 Difference]: Start difference. First operand 844 states and 1239 transitions. Second operand 4 states. [2018-11-23 09:54:53,367 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:53,367 INFO L93 Difference]: Finished difference Result 1638 states and 2411 transitions. [2018-11-23 09:54:53,368 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:53,368 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 121 [2018-11-23 09:54:53,368 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:53,370 INFO L225 Difference]: With dead ends: 1638 [2018-11-23 09:54:53,370 INFO L226 Difference]: Without dead ends: 982 [2018-11-23 09:54:53,371 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:53,372 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 982 states. [2018-11-23 09:54:53,386 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 982 to 916. [2018-11-23 09:54:53,386 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 916 states. [2018-11-23 09:54:53,387 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 916 states to 916 states and 1359 transitions. [2018-11-23 09:54:53,387 INFO L78 Accepts]: Start accepts. Automaton has 916 states and 1359 transitions. Word has length 121 [2018-11-23 09:54:53,387 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:53,388 INFO L480 AbstractCegarLoop]: Abstraction has 916 states and 1359 transitions. [2018-11-23 09:54:53,388 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:53,388 INFO L276 IsEmpty]: Start isEmpty. Operand 916 states and 1359 transitions. [2018-11-23 09:54:53,389 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 123 [2018-11-23 09:54:53,389 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:53,390 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:53,390 INFO L423 AbstractCegarLoop]: === Iteration 30 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:53,390 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:53,390 INFO L82 PathProgramCache]: Analyzing trace with hash -1233245309, now seen corresponding path program 1 times [2018-11-23 09:54:53,390 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:53,390 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:53,391 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:53,391 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:53,391 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:53,403 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:53,437 INFO L134 CoverageAnalysis]: Checked inductivity of 155 backedges. 90 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 09:54:53,437 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:53,437 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:53,438 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:53,438 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:53,438 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:53,438 INFO L87 Difference]: Start difference. First operand 916 states and 1359 transitions. Second operand 4 states. [2018-11-23 09:54:53,615 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:53,615 INFO L93 Difference]: Finished difference Result 1951 states and 2859 transitions. [2018-11-23 09:54:53,616 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:53,616 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 122 [2018-11-23 09:54:53,616 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:53,618 INFO L225 Difference]: With dead ends: 1951 [2018-11-23 09:54:53,618 INFO L226 Difference]: Without dead ends: 1048 [2018-11-23 09:54:53,619 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:53,620 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1048 states. [2018-11-23 09:54:53,635 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1048 to 916. [2018-11-23 09:54:53,635 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 916 states. [2018-11-23 09:54:53,636 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 916 states to 916 states and 1354 transitions. [2018-11-23 09:54:53,637 INFO L78 Accepts]: Start accepts. Automaton has 916 states and 1354 transitions. Word has length 122 [2018-11-23 09:54:53,637 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:53,637 INFO L480 AbstractCegarLoop]: Abstraction has 916 states and 1354 transitions. [2018-11-23 09:54:53,637 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:53,637 INFO L276 IsEmpty]: Start isEmpty. Operand 916 states and 1354 transitions. [2018-11-23 09:54:53,639 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 124 [2018-11-23 09:54:53,639 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:53,639 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:53,639 INFO L423 AbstractCegarLoop]: === Iteration 31 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:53,639 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:53,640 INFO L82 PathProgramCache]: Analyzing trace with hash 2124457781, now seen corresponding path program 1 times [2018-11-23 09:54:53,640 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:53,640 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:53,640 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:53,641 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:53,641 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:53,654 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:53,687 INFO L134 CoverageAnalysis]: Checked inductivity of 160 backedges. 95 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 09:54:53,688 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:53,688 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:53,688 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:53,688 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:53,688 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:53,688 INFO L87 Difference]: Start difference. First operand 916 states and 1354 transitions. Second operand 4 states. [2018-11-23 09:54:53,874 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:53,874 INFO L93 Difference]: Finished difference Result 1951 states and 2849 transitions. [2018-11-23 09:54:53,875 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:53,875 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 123 [2018-11-23 09:54:53,876 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:53,878 INFO L225 Difference]: With dead ends: 1951 [2018-11-23 09:54:53,879 INFO L226 Difference]: Without dead ends: 1048 [2018-11-23 09:54:53,880 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:53,881 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1048 states. [2018-11-23 09:54:53,906 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1048 to 916. [2018-11-23 09:54:53,906 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 916 states. [2018-11-23 09:54:53,908 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 916 states to 916 states and 1349 transitions. [2018-11-23 09:54:53,908 INFO L78 Accepts]: Start accepts. Automaton has 916 states and 1349 transitions. Word has length 123 [2018-11-23 09:54:53,908 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:53,909 INFO L480 AbstractCegarLoop]: Abstraction has 916 states and 1349 transitions. [2018-11-23 09:54:53,909 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:53,909 INFO L276 IsEmpty]: Start isEmpty. Operand 916 states and 1349 transitions. [2018-11-23 09:54:53,911 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 125 [2018-11-23 09:54:53,911 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:53,911 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 6, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:53,911 INFO L423 AbstractCegarLoop]: === Iteration 32 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:53,911 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:53,912 INFO L82 PathProgramCache]: Analyzing trace with hash 805588424, now seen corresponding path program 1 times [2018-11-23 09:54:53,912 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:53,912 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:53,913 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:53,913 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:53,913 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:53,932 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:54,015 INFO L134 CoverageAnalysis]: Checked inductivity of 165 backedges. 100 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 09:54:54,016 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:54,016 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:54,016 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:54,016 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:54,016 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:54,016 INFO L87 Difference]: Start difference. First operand 916 states and 1349 transitions. Second operand 4 states. [2018-11-23 09:54:54,302 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:54,302 INFO L93 Difference]: Finished difference Result 1906 states and 2784 transitions. [2018-11-23 09:54:54,304 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:54,304 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 124 [2018-11-23 09:54:54,304 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:54,307 INFO L225 Difference]: With dead ends: 1906 [2018-11-23 09:54:54,307 INFO L226 Difference]: Without dead ends: 1003 [2018-11-23 09:54:54,310 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:54,312 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1003 states. [2018-11-23 09:54:54,338 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1003 to 916. [2018-11-23 09:54:54,338 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 916 states. [2018-11-23 09:54:54,340 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 916 states to 916 states and 1344 transitions. [2018-11-23 09:54:54,340 INFO L78 Accepts]: Start accepts. Automaton has 916 states and 1344 transitions. Word has length 124 [2018-11-23 09:54:54,341 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:54,341 INFO L480 AbstractCegarLoop]: Abstraction has 916 states and 1344 transitions. [2018-11-23 09:54:54,341 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:54,341 INFO L276 IsEmpty]: Start isEmpty. Operand 916 states and 1344 transitions. [2018-11-23 09:54:54,343 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 125 [2018-11-23 09:54:54,343 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:54,344 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 6, 6, 5, 5, 5, 5, 5, 4, 4, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:54,344 INFO L423 AbstractCegarLoop]: === Iteration 33 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:54,344 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:54,344 INFO L82 PathProgramCache]: Analyzing trace with hash -1158112039, now seen corresponding path program 1 times [2018-11-23 09:54:54,344 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:54,344 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:54,345 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:54,345 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:54,345 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:54,361 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:54,434 INFO L134 CoverageAnalysis]: Checked inductivity of 187 backedges. 68 proven. 0 refuted. 0 times theorem prover too weak. 119 trivial. 0 not checked. [2018-11-23 09:54:54,434 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:54,434 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 09:54:54,435 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 09:54:54,435 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 09:54:54,435 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 09:54:54,435 INFO L87 Difference]: Start difference. First operand 916 states and 1344 transitions. Second operand 4 states. [2018-11-23 09:54:54,749 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:54,749 INFO L93 Difference]: Finished difference Result 2051 states and 3014 transitions. [2018-11-23 09:54:54,750 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 09:54:54,750 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 124 [2018-11-23 09:54:54,750 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:54,753 INFO L225 Difference]: With dead ends: 2051 [2018-11-23 09:54:54,754 INFO L226 Difference]: Without dead ends: 1148 [2018-11-23 09:54:54,755 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 09:54:54,756 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1148 states. [2018-11-23 09:54:54,800 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1148 to 1026. [2018-11-23 09:54:54,800 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 1026 states. [2018-11-23 09:54:54,802 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1026 states to 1026 states and 1534 transitions. [2018-11-23 09:54:54,802 INFO L78 Accepts]: Start accepts. Automaton has 1026 states and 1534 transitions. Word has length 124 [2018-11-23 09:54:54,802 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:54,802 INFO L480 AbstractCegarLoop]: Abstraction has 1026 states and 1534 transitions. [2018-11-23 09:54:54,802 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 09:54:54,802 INFO L276 IsEmpty]: Start isEmpty. Operand 1026 states and 1534 transitions. [2018-11-23 09:54:54,804 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 129 [2018-11-23 09:54:54,804 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:54,805 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 6, 6, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:54,805 INFO L423 AbstractCegarLoop]: === Iteration 34 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:54,805 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:54,805 INFO L82 PathProgramCache]: Analyzing trace with hash -421436053, now seen corresponding path program 1 times [2018-11-23 09:54:54,805 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:54,805 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:54,806 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:54,806 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:54,806 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:54,830 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:54:54,930 INFO L134 CoverageAnalysis]: Checked inductivity of 190 backedges. 15 proven. 0 refuted. 0 times theorem prover too weak. 175 trivial. 0 not checked. [2018-11-23 09:54:54,931 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:54:54,931 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2018-11-23 09:54:54,931 INFO L459 AbstractCegarLoop]: Interpolant automaton has 6 states [2018-11-23 09:54:54,931 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2018-11-23 09:54:54,931 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=9, Invalid=21, Unknown=0, NotChecked=0, Total=30 [2018-11-23 09:54:54,932 INFO L87 Difference]: Start difference. First operand 1026 states and 1534 transitions. Second operand 6 states. [2018-11-23 09:54:55,193 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:54:55,194 INFO L93 Difference]: Finished difference Result 2043 states and 3056 transitions. [2018-11-23 09:54:55,195 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 6 states. [2018-11-23 09:54:55,195 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 128 [2018-11-23 09:54:55,195 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:54:55,198 INFO L225 Difference]: With dead ends: 2043 [2018-11-23 09:54:55,198 INFO L226 Difference]: Without dead ends: 1030 [2018-11-23 09:54:55,200 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 11 GetRequests, 2 SyntacticMatches, 3 SemanticMatches, 6 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=19, Invalid=37, Unknown=0, NotChecked=0, Total=56 [2018-11-23 09:54:55,201 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1030 states. [2018-11-23 09:54:55,227 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1030 to 1029. [2018-11-23 09:54:55,227 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 1029 states. [2018-11-23 09:54:55,228 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1029 states to 1029 states and 1537 transitions. [2018-11-23 09:54:55,229 INFO L78 Accepts]: Start accepts. Automaton has 1029 states and 1537 transitions. Word has length 128 [2018-11-23 09:54:55,229 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:54:55,229 INFO L480 AbstractCegarLoop]: Abstraction has 1029 states and 1537 transitions. [2018-11-23 09:54:55,229 INFO L481 AbstractCegarLoop]: Interpolant automaton has 6 states. [2018-11-23 09:54:55,229 INFO L276 IsEmpty]: Start isEmpty. Operand 1029 states and 1537 transitions. [2018-11-23 09:54:55,231 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 144 [2018-11-23 09:54:55,231 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:54:55,231 INFO L402 BasicCegarLoop]: trace histogram [7, 7, 6, 6, 6, 6, 6, 6, 6, 6, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:54:55,231 INFO L423 AbstractCegarLoop]: === Iteration 35 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:54:55,231 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:54:55,232 INFO L82 PathProgramCache]: Analyzing trace with hash 1528997636, now seen corresponding path program 1 times [2018-11-23 09:54:55,232 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 09:54:55,232 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 09:54:55,233 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:55,233 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:54:55,233 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 09:54:55,401 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 09:54:55,483 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 09:54:55,533 INFO L469 BasicCegarLoop]: Counterexample might be feasible ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=20503, |#NULL.offset|=20536, |old(#NULL.base)|=20503, |old(#NULL.offset)|=20536, |old(~#SSLv3_client_data~0.base)|=20488, |old(~#SSLv3_client_data~0.offset)|=20485, |old(~init~0)|=20542, |~#SSLv3_client_data~0.base|=20488, |~#SSLv3_client_data~0.offset|=20485, ~init~0=20542] [?] #NULL.base, #NULL.offset := 0, 0;#valid := #valid[0 := 0];~init~0 := 1;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100);call write~init~int(0, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 4 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 8 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 12 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 16 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 20 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 24 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 28 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 32 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 36 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 40 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 44 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 48 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 52 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 56 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 60 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 64 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 68 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 72 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 76 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 80 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 84 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 88 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 92 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 96 + ~#SSLv3_client_data~0.offset, 4); VAL [|#NULL.base|=0, |#NULL.offset|=0, |old(#NULL.base)|=20503, |old(#NULL.offset)|=20536, |old(~#SSLv3_client_data~0.base)|=20488, |old(~#SSLv3_client_data~0.offset)|=20485, |old(~init~0)|=20542, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume true; VAL [|#NULL.base|=0, |#NULL.offset|=0, |old(#NULL.base)|=20503, |old(#NULL.offset)|=20536, |old(~#SSLv3_client_data~0.base)|=20488, |old(~#SSLv3_client_data~0.offset)|=20485, |old(~init~0)|=20542, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] RET #542#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] havoc ~s~0.base, ~s~0.offset;call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, 84 + ~s~0.offset, 4);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, 204 + ~s~0.offset, 4);call write~int(12292, ~s~0.base, 52 + ~s~0.offset, 4);assume -2147483648 <= #t~nondet6 && #t~nondet6 <= 2147483647;call write~int(#t~nondet6, ~s~0.base, ~s~0.offset, 4);havoc #t~nondet6; VAL [main_~s~0.base=20498, main_~s~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |main_#t~malloc3.base|=20498, |main_#t~malloc3.offset|=0, |main_#t~malloc4.base|=20502, |main_#t~malloc4.offset|=0, |main_#t~malloc5.base|=20545, |main_#t~malloc5.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] CALL call #t~ret7 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~s.base, ~s.offset := #in~s.base, #in~s.offset;~buf~0.base, ~buf~0.offset := #t~nondet8.base, #t~nondet8.offset;havoc #t~nondet8.base, #t~nondet8.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;havoc ~tmp___0~1.base, ~tmp___0~1.offset;assume -2147483648 <= #t~nondet9 && #t~nondet9 <= 2147483647;~tmp___1~0 := #t~nondet9;havoc #t~nondet9;assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647;~tmp___2~0 := #t~nondet10;havoc #t~nondet10;havoc ~tmp___3~0;havoc ~tmp___4~0;havoc ~tmp___5~0;havoc ~tmp___6~0;havoc ~tmp___7~0;havoc ~tmp___8~0;havoc ~tmp___9~0;havoc ~blastFlag~0;~blastFlag~0 := 0;call write~int(12292, ~s.base, 52 + ~s.offset, 4);assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647;call write~int(#t~nondet11, ~s.base, 92 + ~s.offset, 4);havoc #t~nondet11;assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647;~tmp~2 := #t~nondet12;havoc #t~nondet12;~cb~0.base, ~cb~0.offset := 0, 0;~ret~0 := -1;~skip~0 := 0;call #t~malloc13.base, #t~malloc13.offset := #Ultimate.alloc(4);~tmp___0~1.base, ~tmp___0~1.offset := #t~malloc13.base, #t~malloc13.offset;call write~int(0, ~tmp___0~1.base, ~tmp___0~1.offset, 4);call #t~mem14.base, #t~mem14.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=0, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem14.base|=6, |ssl3_connect_#t~mem14.offset|=(- 5), |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 0 != (#t~mem14.base + #t~mem14.offset) % 4294967296;havoc #t~mem14.base, #t~mem14.offset;call #t~mem15.base, #t~mem15.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4);~cb~0.base, ~cb~0.offset := #t~mem15.base, #t~mem15.offset;havoc #t~mem15.base, #t~mem15.offset; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem20 := read~int(~s.base, 28 + ~s.offset, 4);call write~int(1 + #t~mem20, ~s.base, 28 + ~s.offset, 4);havoc #t~mem20; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 != ~bitwiseAnd(~tmp___1~0, 12288)); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem21;havoc #t~mem21;call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem22|=12292, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 12292 == #t~mem22;havoc #t~mem22; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(1, ~s.base, 40 + ~s.offset, 4);call write~int(4096, ~s.base, 52 + ~s.offset, 4);call #t~mem55.base, #t~mem55.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4);call #t~mem56 := read~int(#t~mem55.base, 64 + #t~mem55.offset, 4);call write~int(1 + #t~mem56, #t~mem55.base, 64 + #t~mem55.offset, 4);havoc #t~mem55.base, #t~mem55.offset;havoc #t~mem56; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(0, ~s.base, 36 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 0 != (~cb~0.base + ~cb~0.offset) % 4294967296; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem57 := read~int(~s.base, ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem57|=1, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(768 != ~bitwiseAnd(#t~mem57, 65280));havoc #t~mem57;call write~int(4096, ~s.base, 4 + ~s.offset, 4);call #t~mem58.base, #t~mem58.offset := read~$Pointer$(~s.base, 60 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem58.base|=3, |ssl3_connect_#t~mem58.offset|=(- 2), |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == (#t~mem58.base + #t~mem58.offset) % 4294967296);havoc #t~mem58.base, #t~mem58.offset; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet60 && #t~nondet60 <= 2147483647;~tmp___4~0 := #t~nondet60;havoc #t~nondet60; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == ~tmp___4~0);assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647;~tmp___5~0 := #t~nondet61;havoc #t~nondet61; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == ~tmp___5~0);call write~int(4368, ~s.base, 52 + ~s.offset, 4);call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4);call #t~mem63 := read~int(#t~mem62.base, 60 + #t~mem62.offset, 4);call write~int(1 + #t~mem63, #t~mem62.base, 60 + #t~mem62.offset, 4);havoc #t~mem63;havoc #t~mem62.base, #t~mem62.offset;call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem127.base|=20502, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20535, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem21;havoc #t~mem21;call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem22|=4368, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem22);havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem23|=4368, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem24|=4368, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem25|=4368, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem26|=4368, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem27|=4368, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4368 == #t~mem27;havoc #t~mem27; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(0, ~s.base, 48 + ~s.offset, 4);assume -2147483648 <= #t~nondet64 && #t~nondet64 <= 2147483647;~ret~0 := #t~nondet64;havoc #t~nondet64; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 0 == ~blastFlag~0;~blastFlag~0 := 1; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call write~int(4384, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4);call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, 20 + ~s.offset, 4);call #t~mem66.base, #t~mem66.offset := read~$Pointer$(~s.base, 16 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem65.base|=0, |ssl3_connect_#t~mem65.offset|=0, |ssl3_connect_#t~mem66.base|=0, |ssl3_connect_#t~mem66.offset|=1, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume (#t~mem65.base + #t~mem65.offset) % 4294967296 != (#t~mem66.base + #t~mem66.offset) % 4294967296;havoc #t~mem65.base, #t~mem65.offset;havoc #t~mem66.base, #t~mem66.offset; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem127.base|=20502, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20535, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem21;havoc #t~mem21;call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem22|=4384, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem22);havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem23|=4384, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem24|=4384, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem25|=4384, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem26|=4384, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem27|=4384, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem28|=4384, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem29|=4384, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4384 == #t~mem29;havoc #t~mem29; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet67 && #t~nondet67 <= 2147483647;~ret~0 := #t~nondet67;havoc #t~nondet67; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 1 == ~blastFlag~0;~blastFlag~0 := 2; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call #t~mem68 := read~int(~s.base, 92 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem68|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 != #t~mem68);havoc #t~mem68;call write~int(4400, ~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem127.base|=20502, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20535, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem21;havoc #t~mem21;call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem22|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem22);havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem23|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem24|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem25|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem26|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem27|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem28|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem29|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem30|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem31|=4400, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4400 == #t~mem31;havoc #t~mem31; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem69.base, #t~mem69.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(#t~mem69.base, 836 + #t~mem69.offset, 4);call #t~mem71 := read~int(#t~mem70.base, 12 + #t~mem70.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=10, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem69.base|=20502, |ssl3_connect_#t~mem69.offset|=0, |ssl3_connect_#t~mem70.base|=20541, |ssl3_connect_#t~mem70.offset|=0, |ssl3_connect_#t~mem71|=20524, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 != ~bitwiseAnd(#t~mem71, 256) % 4294967296);havoc #t~mem70.base, #t~mem70.offset;havoc #t~mem71;havoc #t~mem69.base, #t~mem69.offset;assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647;~ret~0 := #t~nondet72;havoc #t~nondet72; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 2 == ~blastFlag~0;~blastFlag~0 := 3; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(4416, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem127.base|=20502, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20535, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem21;havoc #t~mem21;call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem22|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem22);havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem23|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem24|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem25|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem26|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem27|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem28|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem29|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem30|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem31|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4400 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem32|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4401 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem33|=4416, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4416 == #t~mem33;havoc #t~mem33; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647;~ret~0 := #t~nondet73;havoc #t~nondet73; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 3 == ~blastFlag~0;~blastFlag~0 := 4; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call write~int(4432, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4);assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647;~tmp___6~0 := #t~nondet74;havoc #t~nondet74; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == ~tmp___6~0); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem127.base|=20502, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20535, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem21;havoc #t~mem21;call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem22|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem22);havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem23|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem24|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem25|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem26|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem27|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem28|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem29|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem30|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem31|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4400 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem32|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4401 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem33|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4416 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem34|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4417 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem35|=4432, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4432 == #t~mem35;havoc #t~mem35; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=11, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647;~ret~0 := #t~nondet75;havoc #t~nondet75; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(5 == ~blastFlag~0); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call write~int(4448, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem127.base|=20502, |ssl3_connect_#t~mem127.offset|=0, |ssl3_connect_#t~mem128|=20535, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem128);havoc #t~mem128;havoc #t~mem127.base, #t~mem127.offset; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem21;havoc #t~mem21;call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem22|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem22);havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem23|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem24|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem25|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem26|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem27|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem28|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem29|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem30|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem31|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4400 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem32|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4401 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem33|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4416 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem34|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4417 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem35|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4432 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem36|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4433 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |ssl3_connect_#t~mem37|=4448, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4448 == #t~mem37;havoc #t~mem37; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647;~ret~0 := #t~nondet76;havoc #t~nondet76; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=0, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4 == ~blastFlag~0; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=0, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20507, ssl3_connect_~buf~0.offset=20513, ssl3_connect_~cb~0.base=6, ssl3_connect_~cb~0.offset=(- 5), ssl3_connect_~ret~0=0, ssl3_connect_~s.base=20498, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20530, ssl3_connect_~tmp___0~1.offset=0, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20498, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~malloc13.base|=20530, |ssl3_connect_#t~malloc13.offset|=0, |~#SSLv3_client_data~0.base|=20490, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=20503, #NULL.offset=20536, old(#NULL.base)=20503, old(#NULL.offset)=20536, old(~#SSLv3_client_data~0.base)=20488, old(~#SSLv3_client_data~0.offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0.base=20488, ~#SSLv3_client_data~0.offset=20485, ~init~0=20542] [?] #NULL.base, #NULL.offset := 0, 0; [?] #valid := #valid[0 := 0]; [L1039] ~init~0 := 1; [L1040] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100); [L1040] call write~init~int(0, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 4 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 8 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 12 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 16 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 20 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 24 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 28 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 32 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 36 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 40 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 44 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 48 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 52 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 56 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 60 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 64 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 68 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 72 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 76 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 80 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 84 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 88 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 92 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 96 + ~#SSLv3_client_data~0.offset, 4); VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20503, old(#NULL.offset)=20536, old(~#SSLv3_client_data~0.base)=20488, old(~#SSLv3_client_data~0.offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] ensures true; VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20503, old(#NULL.offset)=20536, old(~#SSLv3_client_data~0.base)=20488, old(~#SSLv3_client_data~0.offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1062] havoc ~s~0.base, ~s~0.offset; [L1066] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248); [L1066] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1067] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899); [L1067] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, 84 + ~s~0.offset, 4); [L1068] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232); [L1068] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, 204 + ~s~0.offset, 4); [L1069] call write~int(12292, ~s~0.base, 52 + ~s~0.offset, 4); [L1070] assume -2147483648 <= #t~nondet6 && #t~nondet6 <= 2147483647; [L1070] call write~int(#t~nondet6, ~s~0.base, ~s~0.offset, 4); [L1070] havoc #t~nondet6; VAL [#NULL.base=0, #NULL.offset=0, #t~malloc3.base=20498, #t~malloc3.offset=0, #t~malloc4.base=20502, #t~malloc4.offset=0, #t~malloc5.base=20545, #t~malloc5.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1, ~s~0.base=20498, ~s~0.offset=0] [L1071] CALL call #t~ret7 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1076-L1647] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1077] ~buf~0.base, ~buf~0.offset := #t~nondet8.base, #t~nondet8.offset; [L1077] havoc #t~nondet8.base, #t~nondet8.offset; [L1078] havoc ~tmp~2; [L1079] havoc ~l~0; [L1080] havoc ~num1~0; [L1081] havoc ~cb~0.base, ~cb~0.offset; [L1082] havoc ~ret~0; [L1083] havoc ~new_state~0; [L1084] havoc ~state~0; [L1085] havoc ~skip~0; [L1086] havoc ~tmp___0~1.base, ~tmp___0~1.offset; [L1087] assume -2147483648 <= #t~nondet9 && #t~nondet9 <= 2147483647; [L1087] ~tmp___1~0 := #t~nondet9; [L1087] havoc #t~nondet9; [L1088] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1088] ~tmp___2~0 := #t~nondet10; [L1088] havoc #t~nondet10; [L1089] havoc ~tmp___3~0; [L1090] havoc ~tmp___4~0; [L1091] havoc ~tmp___5~0; [L1092] havoc ~tmp___6~0; [L1093] havoc ~tmp___7~0; [L1094] havoc ~tmp___8~0; [L1095] havoc ~tmp___9~0; [L1097] havoc ~blastFlag~0; [L1100] ~blastFlag~0 := 0; [L1101] call write~int(12292, ~s.base, 52 + ~s.offset, 4); [L1102] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1102] call write~int(#t~nondet11, ~s.base, 92 + ~s.offset, 4); [L1102] havoc #t~nondet11; [L1104] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1104] ~tmp~2 := #t~nondet12; [L1104] havoc #t~nondet12; [L1105] ~cb~0.base, ~cb~0.offset := 0, 0; [L1106] ~ret~0 := -1; [L1107] ~skip~0 := 0; [L1108] call #t~malloc13.base, #t~malloc13.offset := #Ultimate.alloc(4); [L1108] ~tmp___0~1.base, ~tmp___0~1.offset := #t~malloc13.base, #t~malloc13.offset; [L1109] call write~int(0, ~tmp___0~1.base, ~tmp___0~1.offset, 4); [L1110] call #t~mem14.base, #t~mem14.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem14.base=6, #t~mem14.offset=-5, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=0, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1110-L1118] assume 0 != (#t~mem14.base + #t~mem14.offset) % 4294967296; [L1110] havoc #t~mem14.base, #t~mem14.offset; [L1111] call #t~mem15.base, #t~mem15.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem15.base, #t~mem15.offset; [L1111] havoc #t~mem15.base, #t~mem15.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1119] call #t~mem20 := read~int(~s.base, 28 + ~s.offset, 4); [L1119] call write~int(1 + #t~mem20, ~s.base, 28 + ~s.offset, 4); [L1119] havoc #t~mem20; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120-L1128] assume !(0 != ~bitwiseAnd(~tmp___1~0, 12288)); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=12292, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133-L1603] assume 12292 == #t~mem22; [L1133] havoc #t~mem22; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1236] call write~int(1, ~s.base, 40 + ~s.offset, 4); [L1237] call write~int(4096, ~s.base, 52 + ~s.offset, 4); [L1238] call #t~mem55.base, #t~mem55.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1238] call #t~mem56 := read~int(#t~mem55.base, 64 + #t~mem55.offset, 4); [L1238] call write~int(1 + #t~mem56, #t~mem55.base, 64 + #t~mem55.offset, 4); [L1238] havoc #t~mem55.base, #t~mem55.offset; [L1238] havoc #t~mem56; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1243] call write~int(0, ~s.base, 36 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244-L1248] assume 0 != (~cb~0.base + ~cb~0.offset) % 4294967296; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] call #t~mem57 := read~int(~s.base, ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem57=1, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249-L1254] assume !(768 != ~bitwiseAnd(#t~mem57, 65280)); [L1249] havoc #t~mem57; [L1255] call write~int(4096, ~s.base, 4 + ~s.offset, 4); [L1256] call #t~mem58.base, #t~mem58.offset := read~$Pointer$(~s.base, 60 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem58.base=3, #t~mem58.offset=-2, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1256-L1267] assume !(0 == (#t~mem58.base + #t~mem58.offset) % 4294967296); [L1256] havoc #t~mem58.base, #t~mem58.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1268] assume -2147483648 <= #t~nondet60 && #t~nondet60 <= 2147483647; [L1268] ~tmp___4~0 := #t~nondet60; [L1268] havoc #t~nondet60; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1269-L1274] assume !(0 == ~tmp___4~0); [L1275] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1275] ~tmp___5~0 := #t~nondet61; [L1275] havoc #t~nondet61; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1276-L1281] assume !(0 == ~tmp___5~0); [L1282] call write~int(4368, ~s.base, 52 + ~s.offset, 4); [L1283] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1283] call #t~mem63 := read~int(#t~mem62.base, 60 + #t~mem62.offset, 4); [L1283] call write~int(1 + #t~mem63, #t~mem62.base, 60 + #t~mem62.offset, 4); [L1283] havoc #t~mem63; [L1283] havoc #t~mem62.base, #t~mem62.offset; [L1284] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148-L1598] assume 4368 == #t~mem27; [L1148] havoc #t~mem27; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1288] call write~int(0, ~s.base, 48 + ~s.offset, 4); [L1289] assume -2147483648 <= #t~nondet64 && #t~nondet64 <= 2147483647; [L1289] ~ret~0 := #t~nondet64; [L1289] havoc #t~nondet64; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1290-L1294] assume 0 == ~blastFlag~0; [L1291] ~blastFlag~0 := 1; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1295-L1299] assume !(~ret~0 <= 0); [L1300] call write~int(4384, ~s.base, 52 + ~s.offset, 4); [L1301] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1302] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, 20 + ~s.offset, 4); [L1302] call #t~mem66.base, #t~mem66.offset := read~$Pointer$(~s.base, 16 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem65.base=0, #t~mem65.offset=0, #t~mem66.base=0, #t~mem66.offset=1, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1302-L1306] assume (#t~mem65.base + #t~mem65.offset) % 4294967296 != (#t~mem66.base + #t~mem66.offset) % 4294967296; [L1302] havoc #t~mem65.base, #t~mem65.offset; [L1302] havoc #t~mem66.base, #t~mem66.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154-L1596] assume 4384 == #t~mem29; [L1154] havoc #t~mem29; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1310] assume -2147483648 <= #t~nondet67 && #t~nondet67 <= 2147483647; [L1310] ~ret~0 := #t~nondet67; [L1310] havoc #t~nondet67; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311-L1315] assume 1 == ~blastFlag~0; [L1312] ~blastFlag~0 := 2; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1316-L1320] assume !(~ret~0 <= 0); [L1321] call #t~mem68 := read~int(~s.base, 92 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem68=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1321-L1325] assume !(0 != #t~mem68); [L1321] havoc #t~mem68; [L1324] call write~int(4400, ~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1326] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154-L1596] assume !(4384 == #t~mem29); [L1154] havoc #t~mem29; [L1157] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem30=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157-L1595] assume !(4385 == #t~mem30); [L1157] havoc #t~mem30; [L1160] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem31=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160-L1594] assume 4400 == #t~mem31; [L1160] havoc #t~mem31; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330] call #t~mem69.base, #t~mem69.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1330] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(#t~mem69.base, 836 + #t~mem69.offset, 4); [L1330] call #t~mem71 := read~int(#t~mem70.base, 12 + #t~mem70.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem69.base=20502, #t~mem69.offset=0, #t~mem70.base=20541, #t~mem70.offset=0, #t~mem71=20524, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330-L1344] assume !(0 != ~bitwiseAnd(#t~mem71, 256) % 4294967296); [L1330] havoc #t~mem70.base, #t~mem70.offset; [L1330] havoc #t~mem71; [L1330] havoc #t~mem69.base, #t~mem69.offset; [L1333] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1333] ~ret~0 := #t~nondet72; [L1333] havoc #t~nondet72; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1334-L1338] assume 2 == ~blastFlag~0; [L1335] ~blastFlag~0 := 3; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1339-L1343] assume !(~ret~0 <= 0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1345] call write~int(4416, ~s.base, 52 + ~s.offset, 4); [L1346] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154-L1596] assume !(4384 == #t~mem29); [L1154] havoc #t~mem29; [L1157] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem30=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157-L1595] assume !(4385 == #t~mem30); [L1157] havoc #t~mem30; [L1160] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem31=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160-L1594] assume !(4400 == #t~mem31); [L1160] havoc #t~mem31; [L1163] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem32=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1163-L1593] assume !(4401 == #t~mem32); [L1163] havoc #t~mem32; [L1166] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem33=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1166-L1592] assume 4416 == #t~mem33; [L1166] havoc #t~mem33; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1350] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1350] ~ret~0 := #t~nondet73; [L1350] havoc #t~nondet73; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351-L1355] assume 3 == ~blastFlag~0; [L1352] ~blastFlag~0 := 4; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1356-L1360] assume !(~ret~0 <= 0); [L1361] call write~int(4432, ~s.base, 52 + ~s.offset, 4); [L1362] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1363] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1363] ~tmp___6~0 := #t~nondet74; [L1363] havoc #t~nondet74; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1364-L1369] assume !(0 == ~tmp___6~0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154-L1596] assume !(4384 == #t~mem29); [L1154] havoc #t~mem29; [L1157] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem30=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157-L1595] assume !(4385 == #t~mem30); [L1157] havoc #t~mem30; [L1160] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem31=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160-L1594] assume !(4400 == #t~mem31); [L1160] havoc #t~mem31; [L1163] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem32=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163-L1593] assume !(4401 == #t~mem32); [L1163] havoc #t~mem32; [L1166] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem33=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166-L1592] assume !(4416 == #t~mem33); [L1166] havoc #t~mem33; [L1169] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem34=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169-L1591] assume !(4417 == #t~mem34); [L1169] havoc #t~mem34; [L1172] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem35=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172-L1590] assume 4432 == #t~mem35; [L1172] havoc #t~mem35; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1373] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1373] ~ret~0 := #t~nondet75; [L1373] havoc #t~nondet75; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374-L1378] assume !(5 == ~blastFlag~0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1379-L1383] assume !(~ret~0 <= 0); [L1384] call write~int(4448, ~s.base, 52 + ~s.offset, 4); [L1385] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154-L1596] assume !(4384 == #t~mem29); [L1154] havoc #t~mem29; [L1157] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem30=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157-L1595] assume !(4385 == #t~mem30); [L1157] havoc #t~mem30; [L1160] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem31=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160-L1594] assume !(4400 == #t~mem31); [L1160] havoc #t~mem31; [L1163] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem32=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163-L1593] assume !(4401 == #t~mem32); [L1163] havoc #t~mem32; [L1166] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem33=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166-L1592] assume !(4416 == #t~mem33); [L1166] havoc #t~mem33; [L1169] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem34=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169-L1591] assume !(4417 == #t~mem34); [L1169] havoc #t~mem34; [L1172] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem35=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172-L1590] assume !(4432 == #t~mem35); [L1172] havoc #t~mem35; [L1175] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem36=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1175-L1589] assume !(4433 == #t~mem36); [L1175] havoc #t~mem36; [L1178] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem37=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1178-L1588] assume 4448 == #t~mem37; [L1178] havoc #t~mem37; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1389] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1389] ~ret~0 := #t~nondet76; [L1389] havoc #t~nondet76; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390-L1394] assume 4 == ~blastFlag~0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1645] assert false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=20503, #NULL.offset=20536, old(#NULL.base)=20503, old(#NULL.offset)=20536, old(~#SSLv3_client_data~0.base)=20488, old(~#SSLv3_client_data~0.offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0.base=20488, ~#SSLv3_client_data~0.offset=20485, ~init~0=20542] [?] #NULL.base, #NULL.offset := 0, 0; [?] #valid := #valid[0 := 0]; [L1039] ~init~0 := 1; [L1040] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100); [L1040] call write~init~int(0, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 4 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 8 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 12 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 16 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 20 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 24 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 28 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 32 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 36 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 40 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 44 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 48 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 52 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 56 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 60 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 64 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 68 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 72 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 76 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 80 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 84 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 88 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 92 + ~#SSLv3_client_data~0.offset, 4); [L1040] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 96 + ~#SSLv3_client_data~0.offset, 4); VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20503, old(#NULL.offset)=20536, old(~#SSLv3_client_data~0.base)=20488, old(~#SSLv3_client_data~0.offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] ensures true; VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20503, old(#NULL.offset)=20536, old(~#SSLv3_client_data~0.base)=20488, old(~#SSLv3_client_data~0.offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1062] havoc ~s~0.base, ~s~0.offset; [L1066] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248); [L1066] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1067] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899); [L1067] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, 84 + ~s~0.offset, 4); [L1068] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232); [L1068] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, 204 + ~s~0.offset, 4); [L1069] call write~int(12292, ~s~0.base, 52 + ~s~0.offset, 4); [L1070] assume -2147483648 <= #t~nondet6 && #t~nondet6 <= 2147483647; [L1070] call write~int(#t~nondet6, ~s~0.base, ~s~0.offset, 4); [L1070] havoc #t~nondet6; VAL [#NULL.base=0, #NULL.offset=0, #t~malloc3.base=20498, #t~malloc3.offset=0, #t~malloc4.base=20502, #t~malloc4.offset=0, #t~malloc5.base=20545, #t~malloc5.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1, ~s~0.base=20498, ~s~0.offset=0] [L1071] CALL call #t~ret7 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1076-L1647] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1077] ~buf~0.base, ~buf~0.offset := #t~nondet8.base, #t~nondet8.offset; [L1077] havoc #t~nondet8.base, #t~nondet8.offset; [L1078] havoc ~tmp~2; [L1079] havoc ~l~0; [L1080] havoc ~num1~0; [L1081] havoc ~cb~0.base, ~cb~0.offset; [L1082] havoc ~ret~0; [L1083] havoc ~new_state~0; [L1084] havoc ~state~0; [L1085] havoc ~skip~0; [L1086] havoc ~tmp___0~1.base, ~tmp___0~1.offset; [L1087] assume -2147483648 <= #t~nondet9 && #t~nondet9 <= 2147483647; [L1087] ~tmp___1~0 := #t~nondet9; [L1087] havoc #t~nondet9; [L1088] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1088] ~tmp___2~0 := #t~nondet10; [L1088] havoc #t~nondet10; [L1089] havoc ~tmp___3~0; [L1090] havoc ~tmp___4~0; [L1091] havoc ~tmp___5~0; [L1092] havoc ~tmp___6~0; [L1093] havoc ~tmp___7~0; [L1094] havoc ~tmp___8~0; [L1095] havoc ~tmp___9~0; [L1097] havoc ~blastFlag~0; [L1100] ~blastFlag~0 := 0; [L1101] call write~int(12292, ~s.base, 52 + ~s.offset, 4); [L1102] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1102] call write~int(#t~nondet11, ~s.base, 92 + ~s.offset, 4); [L1102] havoc #t~nondet11; [L1104] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1104] ~tmp~2 := #t~nondet12; [L1104] havoc #t~nondet12; [L1105] ~cb~0.base, ~cb~0.offset := 0, 0; [L1106] ~ret~0 := -1; [L1107] ~skip~0 := 0; [L1108] call #t~malloc13.base, #t~malloc13.offset := #Ultimate.alloc(4); [L1108] ~tmp___0~1.base, ~tmp___0~1.offset := #t~malloc13.base, #t~malloc13.offset; [L1109] call write~int(0, ~tmp___0~1.base, ~tmp___0~1.offset, 4); [L1110] call #t~mem14.base, #t~mem14.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem14.base=6, #t~mem14.offset=-5, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=0, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1110-L1118] assume 0 != (#t~mem14.base + #t~mem14.offset) % 4294967296; [L1110] havoc #t~mem14.base, #t~mem14.offset; [L1111] call #t~mem15.base, #t~mem15.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem15.base, #t~mem15.offset; [L1111] havoc #t~mem15.base, #t~mem15.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1119] call #t~mem20 := read~int(~s.base, 28 + ~s.offset, 4); [L1119] call write~int(1 + #t~mem20, ~s.base, 28 + ~s.offset, 4); [L1119] havoc #t~mem20; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120-L1128] assume !(0 != ~bitwiseAnd(~tmp___1~0, 12288)); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=12292, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133-L1603] assume 12292 == #t~mem22; [L1133] havoc #t~mem22; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1236] call write~int(1, ~s.base, 40 + ~s.offset, 4); [L1237] call write~int(4096, ~s.base, 52 + ~s.offset, 4); [L1238] call #t~mem55.base, #t~mem55.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1238] call #t~mem56 := read~int(#t~mem55.base, 64 + #t~mem55.offset, 4); [L1238] call write~int(1 + #t~mem56, #t~mem55.base, 64 + #t~mem55.offset, 4); [L1238] havoc #t~mem55.base, #t~mem55.offset; [L1238] havoc #t~mem56; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1243] call write~int(0, ~s.base, 36 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244-L1248] assume 0 != (~cb~0.base + ~cb~0.offset) % 4294967296; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] call #t~mem57 := read~int(~s.base, ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem57=1, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249-L1254] assume !(768 != ~bitwiseAnd(#t~mem57, 65280)); [L1249] havoc #t~mem57; [L1255] call write~int(4096, ~s.base, 4 + ~s.offset, 4); [L1256] call #t~mem58.base, #t~mem58.offset := read~$Pointer$(~s.base, 60 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem58.base=3, #t~mem58.offset=-2, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1256-L1267] assume !(0 == (#t~mem58.base + #t~mem58.offset) % 4294967296); [L1256] havoc #t~mem58.base, #t~mem58.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1268] assume -2147483648 <= #t~nondet60 && #t~nondet60 <= 2147483647; [L1268] ~tmp___4~0 := #t~nondet60; [L1268] havoc #t~nondet60; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1269-L1274] assume !(0 == ~tmp___4~0); [L1275] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1275] ~tmp___5~0 := #t~nondet61; [L1275] havoc #t~nondet61; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1276-L1281] assume !(0 == ~tmp___5~0); [L1282] call write~int(4368, ~s.base, 52 + ~s.offset, 4); [L1283] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1283] call #t~mem63 := read~int(#t~mem62.base, 60 + #t~mem62.offset, 4); [L1283] call write~int(1 + #t~mem63, #t~mem62.base, 60 + #t~mem62.offset, 4); [L1283] havoc #t~mem63; [L1283] havoc #t~mem62.base, #t~mem62.offset; [L1284] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4368, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148-L1598] assume 4368 == #t~mem27; [L1148] havoc #t~mem27; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=-1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1288] call write~int(0, ~s.base, 48 + ~s.offset, 4); [L1289] assume -2147483648 <= #t~nondet64 && #t~nondet64 <= 2147483647; [L1289] ~ret~0 := #t~nondet64; [L1289] havoc #t~nondet64; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1290-L1294] assume 0 == ~blastFlag~0; [L1291] ~blastFlag~0 := 1; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1295-L1299] assume !(~ret~0 <= 0); [L1300] call write~int(4384, ~s.base, 52 + ~s.offset, 4); [L1301] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1302] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, 20 + ~s.offset, 4); [L1302] call #t~mem66.base, #t~mem66.offset := read~$Pointer$(~s.base, 16 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem65.base=0, #t~mem65.offset=0, #t~mem66.base=0, #t~mem66.offset=1, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1302-L1306] assume (#t~mem65.base + #t~mem65.offset) % 4294967296 != (#t~mem66.base + #t~mem66.offset) % 4294967296; [L1302] havoc #t~mem65.base, #t~mem65.offset; [L1302] havoc #t~mem66.base, #t~mem66.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4384, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154-L1596] assume 4384 == #t~mem29; [L1154] havoc #t~mem29; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1310] assume -2147483648 <= #t~nondet67 && #t~nondet67 <= 2147483647; [L1310] ~ret~0 := #t~nondet67; [L1310] havoc #t~nondet67; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311-L1315] assume 1 == ~blastFlag~0; [L1312] ~blastFlag~0 := 2; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1316-L1320] assume !(~ret~0 <= 0); [L1321] call #t~mem68 := read~int(~s.base, 92 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem68=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1321-L1325] assume !(0 != #t~mem68); [L1321] havoc #t~mem68; [L1324] call write~int(4400, ~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1326] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154-L1596] assume !(4384 == #t~mem29); [L1154] havoc #t~mem29; [L1157] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem30=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157-L1595] assume !(4385 == #t~mem30); [L1157] havoc #t~mem30; [L1160] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem31=4400, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160-L1594] assume 4400 == #t~mem31; [L1160] havoc #t~mem31; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330] call #t~mem69.base, #t~mem69.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1330] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(#t~mem69.base, 836 + #t~mem69.offset, 4); [L1330] call #t~mem71 := read~int(#t~mem70.base, 12 + #t~mem70.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem69.base=20502, #t~mem69.offset=0, #t~mem70.base=20541, #t~mem70.offset=0, #t~mem71=20524, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=10, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330-L1344] assume !(0 != ~bitwiseAnd(#t~mem71, 256) % 4294967296); [L1330] havoc #t~mem70.base, #t~mem70.offset; [L1330] havoc #t~mem71; [L1330] havoc #t~mem69.base, #t~mem69.offset; [L1333] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1333] ~ret~0 := #t~nondet72; [L1333] havoc #t~nondet72; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1334-L1338] assume 2 == ~blastFlag~0; [L1335] ~blastFlag~0 := 3; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1339-L1343] assume !(~ret~0 <= 0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1345] call write~int(4416, ~s.base, 52 + ~s.offset, 4); [L1346] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154-L1596] assume !(4384 == #t~mem29); [L1154] havoc #t~mem29; [L1157] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem30=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157-L1595] assume !(4385 == #t~mem30); [L1157] havoc #t~mem30; [L1160] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem31=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160-L1594] assume !(4400 == #t~mem31); [L1160] havoc #t~mem31; [L1163] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem32=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1163-L1593] assume !(4401 == #t~mem32); [L1163] havoc #t~mem32; [L1166] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem33=4416, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1166-L1592] assume 4416 == #t~mem33; [L1166] havoc #t~mem33; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1350] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1350] ~ret~0 := #t~nondet73; [L1350] havoc #t~nondet73; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351-L1355] assume 3 == ~blastFlag~0; [L1352] ~blastFlag~0 := 4; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1356-L1360] assume !(~ret~0 <= 0); [L1361] call write~int(4432, ~s.base, 52 + ~s.offset, 4); [L1362] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1363] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1363] ~tmp___6~0 := #t~nondet74; [L1363] havoc #t~nondet74; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1364-L1369] assume !(0 == ~tmp___6~0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154-L1596] assume !(4384 == #t~mem29); [L1154] havoc #t~mem29; [L1157] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem30=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157-L1595] assume !(4385 == #t~mem30); [L1157] havoc #t~mem30; [L1160] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem31=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160-L1594] assume !(4400 == #t~mem31); [L1160] havoc #t~mem31; [L1163] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem32=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163-L1593] assume !(4401 == #t~mem32); [L1163] havoc #t~mem32; [L1166] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem33=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166-L1592] assume !(4416 == #t~mem33); [L1166] havoc #t~mem33; [L1169] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem34=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169-L1591] assume !(4417 == #t~mem34); [L1169] havoc #t~mem34; [L1172] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem35=4432, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172-L1590] assume 4432 == #t~mem35; [L1172] havoc #t~mem35; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=11, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1373] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1373] ~ret~0 := #t~nondet75; [L1373] havoc #t~nondet75; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374-L1378] assume !(5 == ~blastFlag~0); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1379-L1383] assume !(~ret~0 <= 0); [L1384] call write~int(4448, ~s.base, 52 + ~s.offset, 4); [L1385] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1604] call #t~mem128 := read~int(#t~mem127.base, 848 + #t~mem127.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem127.base=20502, #t~mem127.offset=0, #t~mem128=20535, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604-L1632] assume !(0 == #t~mem128); [L1604] havoc #t~mem128; [L1604] havoc #t~mem127.base, #t~mem127.offset; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] assume !false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] call #t~mem21 := read~int(~s.base, 52 + ~s.offset, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem22=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133-L1603] assume !(12292 == #t~mem22); [L1133] havoc #t~mem22; [L1136] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem23=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136-L1602] assume !(16384 == #t~mem23); [L1136] havoc #t~mem23; [L1139] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem24=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139-L1601] assume !(4096 == #t~mem24); [L1139] havoc #t~mem24; [L1142] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem25=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142-L1600] assume !(20480 == #t~mem25); [L1142] havoc #t~mem25; [L1145] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem26=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145-L1599] assume !(4099 == #t~mem26); [L1145] havoc #t~mem26; [L1148] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem27=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148-L1598] assume !(4368 == #t~mem27); [L1148] havoc #t~mem27; [L1151] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem28=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151-L1597] assume !(4369 == #t~mem28); [L1151] havoc #t~mem28; [L1154] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem29=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154-L1596] assume !(4384 == #t~mem29); [L1154] havoc #t~mem29; [L1157] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem30=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157-L1595] assume !(4385 == #t~mem30); [L1157] havoc #t~mem30; [L1160] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem31=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160-L1594] assume !(4400 == #t~mem31); [L1160] havoc #t~mem31; [L1163] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem32=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163-L1593] assume !(4401 == #t~mem32); [L1163] havoc #t~mem32; [L1166] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem33=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166-L1592] assume !(4416 == #t~mem33); [L1166] havoc #t~mem33; [L1169] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem34=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169-L1591] assume !(4417 == #t~mem34); [L1169] havoc #t~mem34; [L1172] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem35=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172-L1590] assume !(4432 == #t~mem35); [L1172] havoc #t~mem35; [L1175] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem36=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1175-L1589] assume !(4433 == #t~mem36); [L1175] havoc #t~mem36; [L1178] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, #t~mem37=4448, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1178-L1588] assume 4448 == #t~mem37; [L1178] havoc #t~mem37; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=1, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1389] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1389] ~ret~0 := #t~nondet76; [L1389] havoc #t~nondet76; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390-L1394] assume 4 == ~blastFlag~0; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1645] assert false; VAL [#in~s.base=20498, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~malloc13.base=20530, #t~malloc13.offset=0, ~#SSLv3_client_data~0.base=20490, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20507, ~buf~0.offset=20513, ~cb~0.base=6, ~cb~0.offset=-5, ~init~0=1, ~ret~0=0, ~s.base=20498, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20530, ~tmp___0~1.offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20503, #NULL!offset=20536, old(#NULL!base)=20503, old(#NULL!offset)=20536, old(~#SSLv3_client_data~0!base)=20488, old(~#SSLv3_client_data~0!offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0!base=20488, ~#SSLv3_client_data~0!offset=20485, ~init~0=20542] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1039] ~init~0 := 1; [L1040] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1040] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20503, old(#NULL!offset)=20536, old(~#SSLv3_client_data~0!base)=20488, old(~#SSLv3_client_data~0!offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1062] havoc ~s~0; [L1066] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1066] ~s~0 := #t~malloc3; [L1067] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1067] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1068] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1068] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1069] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1070] assume -2147483648 <= #t~nondet6 && #t~nondet6 <= 2147483647; [L1070] FCALL call write~int(#t~nondet6, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1070] havoc #t~nondet6; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20498, #t~malloc3!offset=0, #t~malloc4!base=20502, #t~malloc4!offset=0, #t~malloc5!base=20545, #t~malloc5!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20498, ~s~0!offset=0] [L1071] CALL call #t~ret7 := ssl3_connect(~s~0); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1076-L1647] ~s := #in~s; [L1077] ~buf~0 := #t~nondet8; [L1077] havoc #t~nondet8; [L1078] havoc ~tmp~2; [L1079] havoc ~l~0; [L1080] havoc ~num1~0; [L1081] havoc ~cb~0; [L1082] havoc ~ret~0; [L1083] havoc ~new_state~0; [L1084] havoc ~state~0; [L1085] havoc ~skip~0; [L1086] havoc ~tmp___0~1; [L1087] assume -2147483648 <= #t~nondet9 && #t~nondet9 <= 2147483647; [L1087] ~tmp___1~0 := #t~nondet9; [L1087] havoc #t~nondet9; [L1088] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1088] ~tmp___2~0 := #t~nondet10; [L1088] havoc #t~nondet10; [L1089] havoc ~tmp___3~0; [L1090] havoc ~tmp___4~0; [L1091] havoc ~tmp___5~0; [L1092] havoc ~tmp___6~0; [L1093] havoc ~tmp___7~0; [L1094] havoc ~tmp___8~0; [L1095] havoc ~tmp___9~0; [L1097] havoc ~blastFlag~0; [L1100] ~blastFlag~0 := 0; [L1101] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1102] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1102] FCALL call write~int(#t~nondet11, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1102] havoc #t~nondet11; [L1104] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1104] ~tmp~2 := #t~nondet12; [L1104] havoc #t~nondet12; [L1105] ~cb~0 := { base: 0, offset: 0 }; [L1106] ~ret~0 := -1; [L1107] ~skip~0 := 0; [L1108] FCALL call #t~malloc13 := #Ultimate.alloc(4); [L1108] ~tmp___0~1 := #t~malloc13; [L1109] FCALL call write~int(0, ~tmp___0~1, 4); [L1110] FCALL call #t~mem14 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem14!base=6, #t~mem14!offset=-5, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1110] COND TRUE 0 != (#t~mem14!base + #t~mem14!offset) % 4294967296 [L1110] havoc #t~mem14; [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1111] ~cb~0 := #t~mem15; [L1111] havoc #t~mem15; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1119] FCALL call #t~mem20 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] FCALL call write~int(1 + #t~mem20, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] havoc #t~mem20; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120-L1128] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=12292, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] COND TRUE 12292 == #t~mem22 [L1133] havoc #t~mem22; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1236] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1237] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1238] FCALL call #t~mem55 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1238] FCALL call #t~mem56 := read~int({ base: #t~mem55!base, offset: 64 + #t~mem55!offset }, 4); [L1238] FCALL call write~int(1 + #t~mem56, { base: #t~mem55!base, offset: 64 + #t~mem55!offset }, 4); [L1238] havoc #t~mem55; [L1238] havoc #t~mem56; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1243] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] FCALL call #t~mem57 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem57=1, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] COND FALSE !(768 != ~bitwiseAnd(#t~mem57, 65280)) [L1249] havoc #t~mem57; [L1255] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1256] FCALL call #t~mem58 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem58!base=3, #t~mem58!offset=-2, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1256] COND FALSE !(0 == (#t~mem58!base + #t~mem58!offset) % 4294967296) [L1256] havoc #t~mem58; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1268] assume -2147483648 <= #t~nondet60 && #t~nondet60 <= 2147483647; [L1268] ~tmp___4~0 := #t~nondet60; [L1268] havoc #t~nondet60; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1269] COND FALSE !(0 == ~tmp___4~0) [L1275] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1275] ~tmp___5~0 := #t~nondet61; [L1275] havoc #t~nondet61; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1276] COND FALSE !(0 == ~tmp___5~0) [L1282] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1283] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1283] FCALL call #t~mem63 := read~int({ base: #t~mem62!base, offset: 60 + #t~mem62!offset }, 4); [L1283] FCALL call write~int(1 + #t~mem63, { base: #t~mem62!base, offset: 60 + #t~mem62!offset }, 4); [L1283] havoc #t~mem63; [L1283] havoc #t~mem62; [L1284] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND TRUE 4368 == #t~mem27 [L1148] havoc #t~mem27; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1288] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1289] assume -2147483648 <= #t~nondet64 && #t~nondet64 <= 2147483647; [L1289] ~ret~0 := #t~nondet64; [L1289] havoc #t~nondet64; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1290] COND TRUE 0 == ~blastFlag~0 [L1291] ~blastFlag~0 := 1; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1295] COND FALSE !(~ret~0 <= 0) [L1300] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1301] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1302] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1302] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem65!base=0, #t~mem65!offset=0, #t~mem66!base=0, #t~mem66!offset=1, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1302] COND TRUE (#t~mem65!base + #t~mem65!offset) % 4294967296 != (#t~mem66!base + #t~mem66!offset) % 4294967296 [L1302] havoc #t~mem65; [L1302] havoc #t~mem66; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND TRUE 4384 == #t~mem29 [L1154] havoc #t~mem29; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1310] assume -2147483648 <= #t~nondet67 && #t~nondet67 <= 2147483647; [L1310] ~ret~0 := #t~nondet67; [L1310] havoc #t~nondet67; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] COND TRUE 1 == ~blastFlag~0 [L1312] ~blastFlag~0 := 2; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1316] COND FALSE !(~ret~0 <= 0) [L1321] FCALL call #t~mem68 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem68=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1321-L1325] COND FALSE !(0 != #t~mem68) [L1321] havoc #t~mem68; [L1324] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1326] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160] COND TRUE 4400 == #t~mem31 [L1160] havoc #t~mem31; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330] FCALL call #t~mem69 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1330] FCALL call #t~mem70 := read~$Pointer$({ base: #t~mem69!base, offset: 836 + #t~mem69!offset }, 4); [L1330] FCALL call #t~mem71 := read~int({ base: #t~mem70!base, offset: 12 + #t~mem70!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem69!base=20502, #t~mem69!offset=0, #t~mem70!base=20541, #t~mem70!offset=0, #t~mem71=20524, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330-L1344] COND FALSE !(0 != ~bitwiseAnd(#t~mem71, 256) % 4294967296) [L1330] havoc #t~mem70; [L1330] havoc #t~mem71; [L1330] havoc #t~mem69; [L1333] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1333] ~ret~0 := #t~nondet72; [L1333] havoc #t~nondet72; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1334] COND TRUE 2 == ~blastFlag~0 [L1335] ~blastFlag~0 := 3; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1339] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1345] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1346] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1166] COND TRUE 4416 == #t~mem33 [L1166] havoc #t~mem33; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1350] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1350] ~ret~0 := #t~nondet73; [L1350] havoc #t~nondet73; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] COND TRUE 3 == ~blastFlag~0 [L1352] ~blastFlag~0 := 4; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1356] COND FALSE !(~ret~0 <= 0) [L1361] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1362] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1363] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1363] ~tmp___6~0 := #t~nondet74; [L1363] havoc #t~nondet74; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1364] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem33) [L1166] havoc #t~mem33; [L1169] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem34) [L1169] havoc #t~mem34; [L1172] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172] COND TRUE 4432 == #t~mem35 [L1172] havoc #t~mem35; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1373] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1373] ~ret~0 := #t~nondet75; [L1373] havoc #t~nondet75; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] COND FALSE !(5 == ~blastFlag~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1379] COND FALSE !(~ret~0 <= 0) [L1384] FCALL call write~int(4448, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1385] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem33) [L1166] havoc #t~mem33; [L1169] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem34=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem34) [L1169] havoc #t~mem34; [L1172] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem35=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172] COND FALSE !(4432 == #t~mem35) [L1172] havoc #t~mem35; [L1175] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem36=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1175] COND FALSE !(4433 == #t~mem36) [L1175] havoc #t~mem36; [L1178] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem37=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1178] COND TRUE 4448 == #t~mem37 [L1178] havoc #t~mem37; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1389] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1389] ~ret~0 := #t~nondet76; [L1389] havoc #t~nondet76; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1645] assert false; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20503, #NULL!offset=20536, old(#NULL!base)=20503, old(#NULL!offset)=20536, old(~#SSLv3_client_data~0!base)=20488, old(~#SSLv3_client_data~0!offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0!base=20488, ~#SSLv3_client_data~0!offset=20485, ~init~0=20542] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1039] ~init~0 := 1; [L1040] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1040] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20503, old(#NULL!offset)=20536, old(~#SSLv3_client_data~0!base)=20488, old(~#SSLv3_client_data~0!offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1062] havoc ~s~0; [L1066] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1066] ~s~0 := #t~malloc3; [L1067] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1067] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1068] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1068] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1069] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1070] assume -2147483648 <= #t~nondet6 && #t~nondet6 <= 2147483647; [L1070] FCALL call write~int(#t~nondet6, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1070] havoc #t~nondet6; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20498, #t~malloc3!offset=0, #t~malloc4!base=20502, #t~malloc4!offset=0, #t~malloc5!base=20545, #t~malloc5!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20498, ~s~0!offset=0] [L1071] CALL call #t~ret7 := ssl3_connect(~s~0); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1076-L1647] ~s := #in~s; [L1077] ~buf~0 := #t~nondet8; [L1077] havoc #t~nondet8; [L1078] havoc ~tmp~2; [L1079] havoc ~l~0; [L1080] havoc ~num1~0; [L1081] havoc ~cb~0; [L1082] havoc ~ret~0; [L1083] havoc ~new_state~0; [L1084] havoc ~state~0; [L1085] havoc ~skip~0; [L1086] havoc ~tmp___0~1; [L1087] assume -2147483648 <= #t~nondet9 && #t~nondet9 <= 2147483647; [L1087] ~tmp___1~0 := #t~nondet9; [L1087] havoc #t~nondet9; [L1088] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1088] ~tmp___2~0 := #t~nondet10; [L1088] havoc #t~nondet10; [L1089] havoc ~tmp___3~0; [L1090] havoc ~tmp___4~0; [L1091] havoc ~tmp___5~0; [L1092] havoc ~tmp___6~0; [L1093] havoc ~tmp___7~0; [L1094] havoc ~tmp___8~0; [L1095] havoc ~tmp___9~0; [L1097] havoc ~blastFlag~0; [L1100] ~blastFlag~0 := 0; [L1101] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1102] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1102] FCALL call write~int(#t~nondet11, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1102] havoc #t~nondet11; [L1104] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1104] ~tmp~2 := #t~nondet12; [L1104] havoc #t~nondet12; [L1105] ~cb~0 := { base: 0, offset: 0 }; [L1106] ~ret~0 := -1; [L1107] ~skip~0 := 0; [L1108] FCALL call #t~malloc13 := #Ultimate.alloc(4); [L1108] ~tmp___0~1 := #t~malloc13; [L1109] FCALL call write~int(0, ~tmp___0~1, 4); [L1110] FCALL call #t~mem14 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem14!base=6, #t~mem14!offset=-5, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1110] COND TRUE 0 != (#t~mem14!base + #t~mem14!offset) % 4294967296 [L1110] havoc #t~mem14; [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1111] ~cb~0 := #t~mem15; [L1111] havoc #t~mem15; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1119] FCALL call #t~mem20 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] FCALL call write~int(1 + #t~mem20, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] havoc #t~mem20; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120-L1128] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=12292, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] COND TRUE 12292 == #t~mem22 [L1133] havoc #t~mem22; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1236] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1237] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1238] FCALL call #t~mem55 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1238] FCALL call #t~mem56 := read~int({ base: #t~mem55!base, offset: 64 + #t~mem55!offset }, 4); [L1238] FCALL call write~int(1 + #t~mem56, { base: #t~mem55!base, offset: 64 + #t~mem55!offset }, 4); [L1238] havoc #t~mem55; [L1238] havoc #t~mem56; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1243] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] FCALL call #t~mem57 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem57=1, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] COND FALSE !(768 != ~bitwiseAnd(#t~mem57, 65280)) [L1249] havoc #t~mem57; [L1255] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1256] FCALL call #t~mem58 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem58!base=3, #t~mem58!offset=-2, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1256] COND FALSE !(0 == (#t~mem58!base + #t~mem58!offset) % 4294967296) [L1256] havoc #t~mem58; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1268] assume -2147483648 <= #t~nondet60 && #t~nondet60 <= 2147483647; [L1268] ~tmp___4~0 := #t~nondet60; [L1268] havoc #t~nondet60; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1269] COND FALSE !(0 == ~tmp___4~0) [L1275] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1275] ~tmp___5~0 := #t~nondet61; [L1275] havoc #t~nondet61; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1276] COND FALSE !(0 == ~tmp___5~0) [L1282] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1283] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1283] FCALL call #t~mem63 := read~int({ base: #t~mem62!base, offset: 60 + #t~mem62!offset }, 4); [L1283] FCALL call write~int(1 + #t~mem63, { base: #t~mem62!base, offset: 60 + #t~mem62!offset }, 4); [L1283] havoc #t~mem63; [L1283] havoc #t~mem62; [L1284] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND TRUE 4368 == #t~mem27 [L1148] havoc #t~mem27; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1288] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1289] assume -2147483648 <= #t~nondet64 && #t~nondet64 <= 2147483647; [L1289] ~ret~0 := #t~nondet64; [L1289] havoc #t~nondet64; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1290] COND TRUE 0 == ~blastFlag~0 [L1291] ~blastFlag~0 := 1; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1295] COND FALSE !(~ret~0 <= 0) [L1300] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1301] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1302] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1302] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem65!base=0, #t~mem65!offset=0, #t~mem66!base=0, #t~mem66!offset=1, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1302] COND TRUE (#t~mem65!base + #t~mem65!offset) % 4294967296 != (#t~mem66!base + #t~mem66!offset) % 4294967296 [L1302] havoc #t~mem65; [L1302] havoc #t~mem66; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND TRUE 4384 == #t~mem29 [L1154] havoc #t~mem29; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1310] assume -2147483648 <= #t~nondet67 && #t~nondet67 <= 2147483647; [L1310] ~ret~0 := #t~nondet67; [L1310] havoc #t~nondet67; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] COND TRUE 1 == ~blastFlag~0 [L1312] ~blastFlag~0 := 2; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1316] COND FALSE !(~ret~0 <= 0) [L1321] FCALL call #t~mem68 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem68=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1321-L1325] COND FALSE !(0 != #t~mem68) [L1321] havoc #t~mem68; [L1324] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1326] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160] COND TRUE 4400 == #t~mem31 [L1160] havoc #t~mem31; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330] FCALL call #t~mem69 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1330] FCALL call #t~mem70 := read~$Pointer$({ base: #t~mem69!base, offset: 836 + #t~mem69!offset }, 4); [L1330] FCALL call #t~mem71 := read~int({ base: #t~mem70!base, offset: 12 + #t~mem70!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem69!base=20502, #t~mem69!offset=0, #t~mem70!base=20541, #t~mem70!offset=0, #t~mem71=20524, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330-L1344] COND FALSE !(0 != ~bitwiseAnd(#t~mem71, 256) % 4294967296) [L1330] havoc #t~mem70; [L1330] havoc #t~mem71; [L1330] havoc #t~mem69; [L1333] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1333] ~ret~0 := #t~nondet72; [L1333] havoc #t~nondet72; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1334] COND TRUE 2 == ~blastFlag~0 [L1335] ~blastFlag~0 := 3; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1339] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1345] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1346] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1166] COND TRUE 4416 == #t~mem33 [L1166] havoc #t~mem33; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1350] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1350] ~ret~0 := #t~nondet73; [L1350] havoc #t~nondet73; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] COND TRUE 3 == ~blastFlag~0 [L1352] ~blastFlag~0 := 4; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1356] COND FALSE !(~ret~0 <= 0) [L1361] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1362] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1363] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1363] ~tmp___6~0 := #t~nondet74; [L1363] havoc #t~nondet74; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1364] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem33) [L1166] havoc #t~mem33; [L1169] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem34) [L1169] havoc #t~mem34; [L1172] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172] COND TRUE 4432 == #t~mem35 [L1172] havoc #t~mem35; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1373] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1373] ~ret~0 := #t~nondet75; [L1373] havoc #t~nondet75; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] COND FALSE !(5 == ~blastFlag~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1379] COND FALSE !(~ret~0 <= 0) [L1384] FCALL call write~int(4448, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1385] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem33) [L1166] havoc #t~mem33; [L1169] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem34=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem34) [L1169] havoc #t~mem34; [L1172] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem35=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172] COND FALSE !(4432 == #t~mem35) [L1172] havoc #t~mem35; [L1175] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem36=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1175] COND FALSE !(4433 == #t~mem36) [L1175] havoc #t~mem36; [L1178] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem37=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1178] COND TRUE 4448 == #t~mem37 [L1178] havoc #t~mem37; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1389] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1389] ~ret~0 := #t~nondet76; [L1389] havoc #t~nondet76; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1645] assert false; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20503, #NULL!offset=20536, old(#NULL!base)=20503, old(#NULL!offset)=20536, old(~#SSLv3_client_data~0!base)=20488, old(~#SSLv3_client_data~0!offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0!base=20488, ~#SSLv3_client_data~0!offset=20485, ~init~0=20542] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1039] ~init~0 := 1; [L1040] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1040] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20503, old(#NULL!offset)=20536, old(~#SSLv3_client_data~0!base)=20488, old(~#SSLv3_client_data~0!offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1062] havoc ~s~0; [L1066] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1066] ~s~0 := #t~malloc3; [L1067] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1067] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1068] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1068] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1069] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1070] assume -2147483648 <= #t~nondet6 && #t~nondet6 <= 2147483647; [L1070] FCALL call write~int(#t~nondet6, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1070] havoc #t~nondet6; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20498, #t~malloc3!offset=0, #t~malloc4!base=20502, #t~malloc4!offset=0, #t~malloc5!base=20545, #t~malloc5!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20498, ~s~0!offset=0] [L1071] CALL call #t~ret7 := ssl3_connect(~s~0); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1076-L1647] ~s := #in~s; [L1077] ~buf~0 := #t~nondet8; [L1077] havoc #t~nondet8; [L1078] havoc ~tmp~2; [L1079] havoc ~l~0; [L1080] havoc ~num1~0; [L1081] havoc ~cb~0; [L1082] havoc ~ret~0; [L1083] havoc ~new_state~0; [L1084] havoc ~state~0; [L1085] havoc ~skip~0; [L1086] havoc ~tmp___0~1; [L1087] assume -2147483648 <= #t~nondet9 && #t~nondet9 <= 2147483647; [L1087] ~tmp___1~0 := #t~nondet9; [L1087] havoc #t~nondet9; [L1088] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1088] ~tmp___2~0 := #t~nondet10; [L1088] havoc #t~nondet10; [L1089] havoc ~tmp___3~0; [L1090] havoc ~tmp___4~0; [L1091] havoc ~tmp___5~0; [L1092] havoc ~tmp___6~0; [L1093] havoc ~tmp___7~0; [L1094] havoc ~tmp___8~0; [L1095] havoc ~tmp___9~0; [L1097] havoc ~blastFlag~0; [L1100] ~blastFlag~0 := 0; [L1101] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1102] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1102] FCALL call write~int(#t~nondet11, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1102] havoc #t~nondet11; [L1104] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1104] ~tmp~2 := #t~nondet12; [L1104] havoc #t~nondet12; [L1105] ~cb~0 := { base: 0, offset: 0 }; [L1106] ~ret~0 := -1; [L1107] ~skip~0 := 0; [L1108] FCALL call #t~malloc13 := #Ultimate.alloc(4); [L1108] ~tmp___0~1 := #t~malloc13; [L1109] FCALL call write~int(0, ~tmp___0~1, 4); [L1110] FCALL call #t~mem14 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem14!base=6, #t~mem14!offset=-5, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1110] COND TRUE 0 != (#t~mem14!base + #t~mem14!offset) % 4294967296 [L1110] havoc #t~mem14; [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1111] ~cb~0 := #t~mem15; [L1111] havoc #t~mem15; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1119] FCALL call #t~mem20 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] FCALL call write~int(1 + #t~mem20, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] havoc #t~mem20; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120-L1128] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=12292, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] COND TRUE 12292 == #t~mem22 [L1133] havoc #t~mem22; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1236] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1237] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1238] FCALL call #t~mem55 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1238] FCALL call #t~mem56 := read~int({ base: #t~mem55!base, offset: 64 + #t~mem55!offset }, 4); [L1238] FCALL call write~int(1 + #t~mem56, { base: #t~mem55!base, offset: 64 + #t~mem55!offset }, 4); [L1238] havoc #t~mem55; [L1238] havoc #t~mem56; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1243] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] FCALL call #t~mem57 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem57=1, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] COND FALSE !(768 != ~bitwiseAnd(#t~mem57, 65280)) [L1249] havoc #t~mem57; [L1255] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1256] FCALL call #t~mem58 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem58!base=3, #t~mem58!offset=-2, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1256] COND FALSE !(0 == (#t~mem58!base + #t~mem58!offset) % 4294967296) [L1256] havoc #t~mem58; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1268] assume -2147483648 <= #t~nondet60 && #t~nondet60 <= 2147483647; [L1268] ~tmp___4~0 := #t~nondet60; [L1268] havoc #t~nondet60; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1269] COND FALSE !(0 == ~tmp___4~0) [L1275] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1275] ~tmp___5~0 := #t~nondet61; [L1275] havoc #t~nondet61; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1276] COND FALSE !(0 == ~tmp___5~0) [L1282] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1283] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1283] FCALL call #t~mem63 := read~int({ base: #t~mem62!base, offset: 60 + #t~mem62!offset }, 4); [L1283] FCALL call write~int(1 + #t~mem63, { base: #t~mem62!base, offset: 60 + #t~mem62!offset }, 4); [L1283] havoc #t~mem63; [L1283] havoc #t~mem62; [L1284] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND TRUE 4368 == #t~mem27 [L1148] havoc #t~mem27; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1288] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1289] assume -2147483648 <= #t~nondet64 && #t~nondet64 <= 2147483647; [L1289] ~ret~0 := #t~nondet64; [L1289] havoc #t~nondet64; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1290] COND TRUE 0 == ~blastFlag~0 [L1291] ~blastFlag~0 := 1; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1295] COND FALSE !(~ret~0 <= 0) [L1300] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1301] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1302] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1302] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem65!base=0, #t~mem65!offset=0, #t~mem66!base=0, #t~mem66!offset=1, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1302] COND TRUE (#t~mem65!base + #t~mem65!offset) % 4294967296 != (#t~mem66!base + #t~mem66!offset) % 4294967296 [L1302] havoc #t~mem65; [L1302] havoc #t~mem66; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND TRUE 4384 == #t~mem29 [L1154] havoc #t~mem29; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1310] assume -2147483648 <= #t~nondet67 && #t~nondet67 <= 2147483647; [L1310] ~ret~0 := #t~nondet67; [L1310] havoc #t~nondet67; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] COND TRUE 1 == ~blastFlag~0 [L1312] ~blastFlag~0 := 2; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1316] COND FALSE !(~ret~0 <= 0) [L1321] FCALL call #t~mem68 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem68=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1321-L1325] COND FALSE !(0 != #t~mem68) [L1321] havoc #t~mem68; [L1324] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1326] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160] COND TRUE 4400 == #t~mem31 [L1160] havoc #t~mem31; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330] FCALL call #t~mem69 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1330] FCALL call #t~mem70 := read~$Pointer$({ base: #t~mem69!base, offset: 836 + #t~mem69!offset }, 4); [L1330] FCALL call #t~mem71 := read~int({ base: #t~mem70!base, offset: 12 + #t~mem70!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem69!base=20502, #t~mem69!offset=0, #t~mem70!base=20541, #t~mem70!offset=0, #t~mem71=20524, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330-L1344] COND FALSE !(0 != ~bitwiseAnd(#t~mem71, 256) % 4294967296) [L1330] havoc #t~mem70; [L1330] havoc #t~mem71; [L1330] havoc #t~mem69; [L1333] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1333] ~ret~0 := #t~nondet72; [L1333] havoc #t~nondet72; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1334] COND TRUE 2 == ~blastFlag~0 [L1335] ~blastFlag~0 := 3; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1339] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1345] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1346] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1166] COND TRUE 4416 == #t~mem33 [L1166] havoc #t~mem33; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1350] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1350] ~ret~0 := #t~nondet73; [L1350] havoc #t~nondet73; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] COND TRUE 3 == ~blastFlag~0 [L1352] ~blastFlag~0 := 4; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1356] COND FALSE !(~ret~0 <= 0) [L1361] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1362] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1363] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1363] ~tmp___6~0 := #t~nondet74; [L1363] havoc #t~nondet74; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1364] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem33) [L1166] havoc #t~mem33; [L1169] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem34) [L1169] havoc #t~mem34; [L1172] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172] COND TRUE 4432 == #t~mem35 [L1172] havoc #t~mem35; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1373] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1373] ~ret~0 := #t~nondet75; [L1373] havoc #t~nondet75; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] COND FALSE !(5 == ~blastFlag~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1379] COND FALSE !(~ret~0 <= 0) [L1384] FCALL call write~int(4448, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1385] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem33) [L1166] havoc #t~mem33; [L1169] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem34=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem34) [L1169] havoc #t~mem34; [L1172] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem35=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172] COND FALSE !(4432 == #t~mem35) [L1172] havoc #t~mem35; [L1175] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem36=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1175] COND FALSE !(4433 == #t~mem36) [L1175] havoc #t~mem36; [L1178] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem37=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1178] COND TRUE 4448 == #t~mem37 [L1178] havoc #t~mem37; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1389] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1389] ~ret~0 := #t~nondet76; [L1389] havoc #t~nondet76; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1645] assert false; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] ----- [2018-11-23 09:54:57,634 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 20488 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# [2018-11-23 09:54:57,635 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 20485 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20503, #NULL!offset=20536, old(#NULL!base)=20503, old(#NULL!offset)=20536, old(~#SSLv3_client_data~0!base)=20488, old(~#SSLv3_client_data~0!offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0!base=20488, ~#SSLv3_client_data~0!offset=20485, ~init~0=20542] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1039] ~init~0 := 1; [L1040] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1040] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1040] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20503, old(#NULL!offset)=20536, old(~#SSLv3_client_data~0!base)=20488, old(~#SSLv3_client_data~0!offset)=20485, old(~init~0)=20542, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1062] havoc ~s~0; [L1066] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1066] ~s~0 := #t~malloc3; [L1067] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1067] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1068] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1068] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1069] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1070] assume -2147483648 <= #t~nondet6 && #t~nondet6 <= 2147483647; [L1070] FCALL call write~int(#t~nondet6, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1070] havoc #t~nondet6; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20498, #t~malloc3!offset=0, #t~malloc4!base=20502, #t~malloc4!offset=0, #t~malloc5!base=20545, #t~malloc5!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20498, ~s~0!offset=0] [L1071] CALL call #t~ret7 := ssl3_connect(~s~0); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1076-L1647] ~s := #in~s; [L1077] ~buf~0 := #t~nondet8; [L1077] havoc #t~nondet8; [L1078] havoc ~tmp~2; [L1079] havoc ~l~0; [L1080] havoc ~num1~0; [L1081] havoc ~cb~0; [L1082] havoc ~ret~0; [L1083] havoc ~new_state~0; [L1084] havoc ~state~0; [L1085] havoc ~skip~0; [L1086] havoc ~tmp___0~1; [L1087] assume -2147483648 <= #t~nondet9 && #t~nondet9 <= 2147483647; [L1087] ~tmp___1~0 := #t~nondet9; [L1087] havoc #t~nondet9; [L1088] assume -2147483648 <= #t~nondet10 && #t~nondet10 <= 2147483647; [L1088] ~tmp___2~0 := #t~nondet10; [L1088] havoc #t~nondet10; [L1089] havoc ~tmp___3~0; [L1090] havoc ~tmp___4~0; [L1091] havoc ~tmp___5~0; [L1092] havoc ~tmp___6~0; [L1093] havoc ~tmp___7~0; [L1094] havoc ~tmp___8~0; [L1095] havoc ~tmp___9~0; [L1097] havoc ~blastFlag~0; [L1100] ~blastFlag~0 := 0; [L1101] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1102] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1102] FCALL call write~int(#t~nondet11, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1102] havoc #t~nondet11; [L1104] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1104] ~tmp~2 := #t~nondet12; [L1104] havoc #t~nondet12; [L1105] ~cb~0 := { base: 0, offset: 0 }; [L1106] ~ret~0 := -1; [L1107] ~skip~0 := 0; [L1108] FCALL call #t~malloc13 := #Ultimate.alloc(4); [L1108] ~tmp___0~1 := #t~malloc13; [L1109] FCALL call write~int(0, ~tmp___0~1, 4); [L1110] FCALL call #t~mem14 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem14!base=6, #t~mem14!offset=-5, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1110] COND TRUE 0 != (#t~mem14!base + #t~mem14!offset) % 4294967296 [L1110] havoc #t~mem14; [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1111] ~cb~0 := #t~mem15; [L1111] havoc #t~mem15; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1119] FCALL call #t~mem20 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] FCALL call write~int(1 + #t~mem20, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1119] havoc #t~mem20; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120-L1128] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=12292, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] COND TRUE 12292 == #t~mem22 [L1133] havoc #t~mem22; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1236] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1237] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1238] FCALL call #t~mem55 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1238] FCALL call #t~mem56 := read~int({ base: #t~mem55!base, offset: 64 + #t~mem55!offset }, 4); [L1238] FCALL call write~int(1 + #t~mem56, { base: #t~mem55!base, offset: 64 + #t~mem55!offset }, 4); [L1238] havoc #t~mem55; [L1238] havoc #t~mem56; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1243] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] FCALL call #t~mem57 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem57=1, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1249] COND FALSE !(768 != ~bitwiseAnd(#t~mem57, 65280)) [L1249] havoc #t~mem57; [L1255] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1256] FCALL call #t~mem58 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem58!base=3, #t~mem58!offset=-2, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1256] COND FALSE !(0 == (#t~mem58!base + #t~mem58!offset) % 4294967296) [L1256] havoc #t~mem58; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1268] assume -2147483648 <= #t~nondet60 && #t~nondet60 <= 2147483647; [L1268] ~tmp___4~0 := #t~nondet60; [L1268] havoc #t~nondet60; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1269] COND FALSE !(0 == ~tmp___4~0) [L1275] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1275] ~tmp___5~0 := #t~nondet61; [L1275] havoc #t~nondet61; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1276] COND FALSE !(0 == ~tmp___5~0) [L1282] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1283] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1283] FCALL call #t~mem63 := read~int({ base: #t~mem62!base, offset: 60 + #t~mem62!offset }, 4); [L1283] FCALL call write~int(1 + #t~mem63, { base: #t~mem62!base, offset: 60 + #t~mem62!offset }, 4); [L1283] havoc #t~mem63; [L1283] havoc #t~mem62; [L1284] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4368, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND TRUE 4368 == #t~mem27 [L1148] havoc #t~mem27; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=-1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1288] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1289] assume -2147483648 <= #t~nondet64 && #t~nondet64 <= 2147483647; [L1289] ~ret~0 := #t~nondet64; [L1289] havoc #t~nondet64; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1290] COND TRUE 0 == ~blastFlag~0 [L1291] ~blastFlag~0 := 1; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1295] COND FALSE !(~ret~0 <= 0) [L1300] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1301] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1302] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1302] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem65!base=0, #t~mem65!offset=0, #t~mem66!base=0, #t~mem66!offset=1, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1302] COND TRUE (#t~mem65!base + #t~mem65!offset) % 4294967296 != (#t~mem66!base + #t~mem66!offset) % 4294967296 [L1302] havoc #t~mem65; [L1302] havoc #t~mem66; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND TRUE 4384 == #t~mem29 [L1154] havoc #t~mem29; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1310] assume -2147483648 <= #t~nondet67 && #t~nondet67 <= 2147483647; [L1310] ~ret~0 := #t~nondet67; [L1310] havoc #t~nondet67; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] COND TRUE 1 == ~blastFlag~0 [L1312] ~blastFlag~0 := 2; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1316] COND FALSE !(~ret~0 <= 0) [L1321] FCALL call #t~mem68 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem68=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1321-L1325] COND FALSE !(0 != #t~mem68) [L1321] havoc #t~mem68; [L1324] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1326] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160] COND TRUE 4400 == #t~mem31 [L1160] havoc #t~mem31; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330] FCALL call #t~mem69 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1330] FCALL call #t~mem70 := read~$Pointer$({ base: #t~mem69!base, offset: 836 + #t~mem69!offset }, 4); [L1330] FCALL call #t~mem71 := read~int({ base: #t~mem70!base, offset: 12 + #t~mem70!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem69!base=20502, #t~mem69!offset=0, #t~mem70!base=20541, #t~mem70!offset=0, #t~mem71=20524, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=10, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1330-L1344] COND FALSE !(0 != ~bitwiseAnd(#t~mem71, 256) % 4294967296) [L1330] havoc #t~mem70; [L1330] havoc #t~mem71; [L1330] havoc #t~mem69; [L1333] assume -2147483648 <= #t~nondet72 && #t~nondet72 <= 2147483647; [L1333] ~ret~0 := #t~nondet72; [L1333] havoc #t~nondet72; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1334] COND TRUE 2 == ~blastFlag~0 [L1335] ~blastFlag~0 := 3; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1339] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1345] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1346] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1166] COND TRUE 4416 == #t~mem33 [L1166] havoc #t~mem33; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1350] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1350] ~ret~0 := #t~nondet73; [L1350] havoc #t~nondet73; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] COND TRUE 3 == ~blastFlag~0 [L1352] ~blastFlag~0 := 4; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1356] COND FALSE !(~ret~0 <= 0) [L1361] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1362] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1363] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1363] ~tmp___6~0 := #t~nondet74; [L1363] havoc #t~nondet74; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1364] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem33) [L1166] havoc #t~mem33; [L1169] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem34) [L1169] havoc #t~mem34; [L1172] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172] COND TRUE 4432 == #t~mem35 [L1172] havoc #t~mem35; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=11, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1373] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1373] ~ret~0 := #t~nondet75; [L1373] havoc #t~nondet75; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] COND FALSE !(5 == ~blastFlag~0) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1379] COND FALSE !(~ret~0 <= 0) [L1384] FCALL call write~int(4448, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1385] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1604] FCALL call #t~mem128 := read~int({ base: #t~mem127!base, offset: 848 + #t~mem127!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem127!base=20502, #t~mem127!offset=0, #t~mem128=20535, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1604] COND FALSE !(0 == #t~mem128) [L1604] havoc #t~mem128; [L1604] havoc #t~mem127; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1633] ~skip~0 := 0; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1130-L1634] COND FALSE !(false) VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1132] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1132] ~state~0 := #t~mem21; [L1132] havoc #t~mem21; [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem22=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] COND FALSE !(12292 == #t~mem22) [L1133] havoc #t~mem22; [L1136] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem23=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1136] COND FALSE !(16384 == #t~mem23) [L1136] havoc #t~mem23; [L1139] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem24=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1139] COND FALSE !(4096 == #t~mem24) [L1139] havoc #t~mem24; [L1142] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem25=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1142] COND FALSE !(20480 == #t~mem25) [L1142] havoc #t~mem25; [L1145] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem26=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1145] COND FALSE !(4099 == #t~mem26) [L1145] havoc #t~mem26; [L1148] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem27=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1148] COND FALSE !(4368 == #t~mem27) [L1148] havoc #t~mem27; [L1151] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem28=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1151] COND FALSE !(4369 == #t~mem28) [L1151] havoc #t~mem28; [L1154] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem29=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1154] COND FALSE !(4384 == #t~mem29) [L1154] havoc #t~mem29; [L1157] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem30=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1157] COND FALSE !(4385 == #t~mem30) [L1157] havoc #t~mem30; [L1160] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem31=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1160] COND FALSE !(4400 == #t~mem31) [L1160] havoc #t~mem31; [L1163] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem32=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1163] COND FALSE !(4401 == #t~mem32) [L1163] havoc #t~mem32; [L1166] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem33=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1166] COND FALSE !(4416 == #t~mem33) [L1166] havoc #t~mem33; [L1169] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem34=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1169] COND FALSE !(4417 == #t~mem34) [L1169] havoc #t~mem34; [L1172] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem35=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1172] COND FALSE !(4432 == #t~mem35) [L1172] havoc #t~mem35; [L1175] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem36=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1175] COND FALSE !(4433 == #t~mem36) [L1175] havoc #t~mem36; [L1178] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, #t~mem37=4448, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1178] COND TRUE 4448 == #t~mem37 [L1178] havoc #t~mem37; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=1, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1389] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1389] ~ret~0 := #t~nondet76; [L1389] havoc #t~nondet76; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1645] assert false; VAL [#in~s!base=20498, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~malloc13!base=20530, #t~malloc13!offset=0, ~#SSLv3_client_data~0!base=20490, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20507, ~buf~0!offset=20513, ~cb~0!base=6, ~cb~0!offset=-5, ~init~0=1, ~ret~0=0, ~s!base=20498, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20530, ~tmp___0~1!offset=0, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1039] static int init = 1; [L1040] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=20542, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={20490:0}] [L1062] SSL *s ; [L1066] s = malloc (sizeof (SSL)) [L1067] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1068] s->ctx = malloc(sizeof(SSL_CTX)) [L1069] s->state = 12292 [L1070] s->version = __VERIFIER_nondet_int() [L1071] CALL ssl3_connect(s) VAL [init=1, s={20498:0}, SSLv3_client_data={20490:0}] [L1077] BUF_MEM *buf = __VERIFIER_nondet_pointer(); [L1078] unsigned long tmp ; [L1079] unsigned long l ; [L1080] long num1 ; [L1081] void (*cb)() ; [L1082] int ret ; [L1083] int new_state ; [L1084] int state ; [L1085] int skip ; [L1086] int *tmp___0 ; [L1087] int tmp___1 = __VERIFIER_nondet_int(); [L1088] int tmp___2 = __VERIFIER_nondet_int(); [L1089] int tmp___3 ; [L1090] int tmp___4 ; [L1091] int tmp___5 ; [L1092] int tmp___6 ; [L1093] int tmp___7 ; [L1094] int tmp___8 ; [L1095] long tmp___9 ; [L1097] int blastFlag ; [L1100] blastFlag = 0 [L1101] s->state = 12292 [L1102] s->hit = __VERIFIER_nondet_int() [L1104] tmp = __VERIFIER_nondet_int() [L1105] cb = (void (*)())((void *)0) [L1106] ret = -1 [L1107] skip = 0 [L1108] tmp___0 = (int*)malloc(sizeof(int)) [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->info_callback={6:-5}, skip=0, SSLv3_client_data={20490:0}, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=12292, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1249] EXPR s->version VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->version=1, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->init_buf={3:-2}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1268] tmp___4 = __VERIFIER_nondet_int() [L1269] COND FALSE !(! tmp___4) [L1275] tmp___5 = __VERIFIER_nondet_int() [L1276] COND FALSE !(! tmp___5) [L1282] s->state = 4368 [L1283] EXPR s->ctx [L1283] EXPR (s->ctx)->stats.sess_connect [L1283] (s->ctx)->stats.sess_connect += 1 [L1284] s->init_num = 0 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1148] COND TRUE s->state == 4368 [L1288] s->shutdown = 0 [L1289] ret = __VERIFIER_nondet_int() [L1290] COND TRUE blastFlag == 0 [L1291] blastFlag = 1 VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1295] COND FALSE !(ret <= 0) [L1300] s->state = 4384 [L1301] s->init_num = 0 [L1302] EXPR s->bbio [L1302] EXPR s->wbio VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->bbio={0:0}, s->wbio={0:1}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1302] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1154] COND TRUE s->state == 4384 [L1310] ret = __VERIFIER_nondet_int() [L1311] COND TRUE blastFlag == 1 [L1312] blastFlag = 2 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1316] COND FALSE !(ret <= 0) [L1321] s->hit VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->hit=0, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1321] COND FALSE !(s->hit) [L1324] s->state = 4400 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1326] s->init_num = 0 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1160] COND TRUE s->state == 4400 [L1330] EXPR s->s3 [L1330] EXPR (s->s3)->tmp.new_cipher [L1330] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={6:-5}, ((s->s3)->tmp.new_cipher)->algorithms=20524, (s->s3)->tmp.new_cipher={20541:0}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1330] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1333] ret = __VERIFIER_nondet_int() [L1334] COND TRUE blastFlag == 2 [L1335] blastFlag = 3 VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1339] COND FALSE !(ret <= 0) VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1345] s->state = 4416 [L1346] s->init_num = 0 VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1166] COND TRUE s->state == 4416 [L1350] ret = __VERIFIER_nondet_int() [L1351] COND TRUE blastFlag == 3 [L1352] blastFlag = 4 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1356] COND FALSE !(ret <= 0) [L1361] s->state = 4432 [L1362] s->init_num = 0 [L1363] tmp___6 = __VERIFIER_nondet_int() [L1364] COND FALSE !(! tmp___6) VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1172] COND TRUE s->state == 4432 [L1373] ret = __VERIFIER_nondet_int() [L1374] COND FALSE !(blastFlag == 5) VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1379] COND FALSE !(ret <= 0) [L1384] s->state = 4448 [L1385] s->init_num = 0 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1172] COND FALSE !(s->state == 4432) [L1175] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1175] COND FALSE !(s->state == 4433) [L1178] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1178] COND TRUE s->state == 4448 [L1389] ret = __VERIFIER_nondet_int() [L1390] COND TRUE blastFlag == 4 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=0, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1645] __VERIFIER_error() VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=0, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] ----- [2018-11-23 09:54:58,458 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 23.11 09:54:58 BoogieIcfgContainer [2018-11-23 09:54:58,458 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2018-11-23 09:54:58,477 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2018-11-23 09:54:58,477 INFO L271 PluginConnector]: Initializing Witness Printer... [2018-11-23 09:54:58,477 INFO L276 PluginConnector]: Witness Printer initialized [2018-11-23 09:54:58,477 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 09:54:45" (3/4) ... [2018-11-23 09:54:58,480 INFO L147 WitnessPrinter]: No result that supports witness generation found [2018-11-23 09:54:58,480 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-23 09:54:58,481 INFO L168 Benchmark]: Toolchain (without parser) took 14254.54 ms. Allocated memory was 1.0 GB in the beginning and 1.5 GB in the end (delta: 423.1 MB). Free memory was 957.5 MB in the beginning and 1.1 GB in the end (delta: -146.0 MB). Peak memory consumption was 277.1 MB. Max. memory is 11.5 GB. [2018-11-23 09:54:58,482 INFO L168 Benchmark]: CDTParser took 0.11 ms. Allocated memory is still 1.0 GB. Free memory is still 985.4 MB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-23 09:54:58,482 INFO L168 Benchmark]: CACSL2BoogieTranslator took 466.54 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 161.5 MB). Free memory was 957.5 MB in the beginning and 1.1 GB in the end (delta: -185.3 MB). Peak memory consumption was 43.9 MB. Max. memory is 11.5 GB. [2018-11-23 09:54:58,482 INFO L168 Benchmark]: Boogie Procedure Inliner took 33.56 ms. Allocated memory is still 1.2 GB. Free memory is still 1.1 GB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-23 09:54:58,483 INFO L168 Benchmark]: Boogie Preprocessor took 62.19 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 10.3 MB). Peak memory consumption was 10.3 MB. Max. memory is 11.5 GB. [2018-11-23 09:54:58,483 INFO L168 Benchmark]: RCFGBuilder took 750.71 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 77.1 MB). Peak memory consumption was 77.1 MB. Max. memory is 11.5 GB. [2018-11-23 09:54:58,483 INFO L168 Benchmark]: TraceAbstraction took 12934.94 ms. Allocated memory was 1.2 GB in the beginning and 1.5 GB in the end (delta: 261.6 MB). Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: -48.1 MB). Peak memory consumption was 213.5 MB. Max. memory is 11.5 GB. [2018-11-23 09:54:58,484 INFO L168 Benchmark]: Witness Printer took 3.30 ms. Allocated memory is still 1.5 GB. Free memory is still 1.1 GB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-23 09:54:58,486 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.11 ms. Allocated memory is still 1.0 GB. Free memory is still 985.4 MB. There was no memory consumed. Max. memory is 11.5 GB. * CACSL2BoogieTranslator took 466.54 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 161.5 MB). Free memory was 957.5 MB in the beginning and 1.1 GB in the end (delta: -185.3 MB). Peak memory consumption was 43.9 MB. Max. memory is 11.5 GB. * Boogie Procedure Inliner took 33.56 ms. Allocated memory is still 1.2 GB. Free memory is still 1.1 GB. There was no memory consumed. Max. memory is 11.5 GB. * Boogie Preprocessor took 62.19 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 10.3 MB). Peak memory consumption was 10.3 MB. Max. memory is 11.5 GB. * RCFGBuilder took 750.71 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 77.1 MB). Peak memory consumption was 77.1 MB. Max. memory is 11.5 GB. * TraceAbstraction took 12934.94 ms. Allocated memory was 1.2 GB in the beginning and 1.5 GB in the end (delta: 261.6 MB). Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: -48.1 MB). Peak memory consumption was 213.5 MB. Max. memory is 11.5 GB. * Witness Printer took 3.30 ms. Allocated memory is still 1.5 GB. Free memory is still 1.1 GB. There was no memory consumed. Max. memory is 11.5 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 20488 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 20485 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - UnprovableResult [Line: 1645]: Unable to prove that call of __VERIFIER_error() unreachable Unable to prove that call of __VERIFIER_error() unreachable Reason: overapproximation of bitwiseAnd at line 1330. Possible FailurePath: [L1039] static int init = 1; [L1040] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=20542, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={20490:0}] [L1062] SSL *s ; [L1066] s = malloc (sizeof (SSL)) [L1067] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1068] s->ctx = malloc(sizeof(SSL_CTX)) [L1069] s->state = 12292 [L1070] s->version = __VERIFIER_nondet_int() [L1071] CALL ssl3_connect(s) VAL [init=1, s={20498:0}, SSLv3_client_data={20490:0}] [L1077] BUF_MEM *buf = __VERIFIER_nondet_pointer(); [L1078] unsigned long tmp ; [L1079] unsigned long l ; [L1080] long num1 ; [L1081] void (*cb)() ; [L1082] int ret ; [L1083] int new_state ; [L1084] int state ; [L1085] int skip ; [L1086] int *tmp___0 ; [L1087] int tmp___1 = __VERIFIER_nondet_int(); [L1088] int tmp___2 = __VERIFIER_nondet_int(); [L1089] int tmp___3 ; [L1090] int tmp___4 ; [L1091] int tmp___5 ; [L1092] int tmp___6 ; [L1093] int tmp___7 ; [L1094] int tmp___8 ; [L1095] long tmp___9 ; [L1097] int blastFlag ; [L1100] blastFlag = 0 [L1101] s->state = 12292 [L1102] s->hit = __VERIFIER_nondet_int() [L1104] tmp = __VERIFIER_nondet_int() [L1105] cb = (void (*)())((void *)0) [L1106] ret = -1 [L1107] skip = 0 [L1108] tmp___0 = (int*)malloc(sizeof(int)) [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->info_callback={6:-5}, skip=0, SSLv3_client_data={20490:0}, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=12292, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1249] EXPR s->version VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->version=1, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->init_buf={3:-2}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1268] tmp___4 = __VERIFIER_nondet_int() [L1269] COND FALSE !(! tmp___4) [L1275] tmp___5 = __VERIFIER_nondet_int() [L1276] COND FALSE !(! tmp___5) [L1282] s->state = 4368 [L1283] EXPR s->ctx [L1283] EXPR (s->ctx)->stats.sess_connect [L1283] (s->ctx)->stats.sess_connect += 1 [L1284] s->init_num = 0 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=12292, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=0, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=-1, s={20498:0}, s={20498:0}, s->state=4368, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1148] COND TRUE s->state == 4368 [L1288] s->shutdown = 0 [L1289] ret = __VERIFIER_nondet_int() [L1290] COND TRUE blastFlag == 0 [L1291] blastFlag = 1 VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1295] COND FALSE !(ret <= 0) [L1300] s->state = 4384 [L1301] s->init_num = 0 [L1302] EXPR s->bbio [L1302] EXPR s->wbio VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->bbio={0:0}, s->wbio={0:1}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1302] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4368, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=1, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4384, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1154] COND TRUE s->state == 4384 [L1310] ret = __VERIFIER_nondet_int() [L1311] COND TRUE blastFlag == 1 [L1312] blastFlag = 2 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1316] COND FALSE !(ret <= 0) [L1321] s->hit VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->hit=0, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1321] COND FALSE !(s->hit) [L1324] s->state = 4400 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1326] s->init_num = 0 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4384, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={6:-5}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->state=4400, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1160] COND TRUE s->state == 4400 [L1330] EXPR s->s3 [L1330] EXPR (s->s3)->tmp.new_cipher [L1330] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={6:-5}, ((s->s3)->tmp.new_cipher)->algorithms=20524, (s->s3)->tmp.new_cipher={20541:0}, blastFlag=2, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=10, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1330] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1333] ret = __VERIFIER_nondet_int() [L1334] COND TRUE blastFlag == 2 [L1335] blastFlag = 3 VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1339] COND FALSE !(ret <= 0) VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1345] s->state = 4416 [L1346] s->init_num = 0 VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4400, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={6:-5}, blastFlag=3, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4416, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1166] COND TRUE s->state == 4416 [L1350] ret = __VERIFIER_nondet_int() [L1351] COND TRUE blastFlag == 3 [L1352] blastFlag = 4 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1356] COND FALSE !(ret <= 0) [L1361] s->state = 4432 [L1362] s->init_num = 0 [L1363] tmp___6 = __VERIFIER_nondet_int() [L1364] COND FALSE !(! tmp___6) VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4416, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=11, s={20498:0}, s={20498:0}, s->state=4432, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1172] COND TRUE s->state == 4432 [L1373] ret = __VERIFIER_nondet_int() [L1374] COND FALSE !(blastFlag == 5) VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1379] COND FALSE !(ret <= 0) [L1384] s->state = 4448 [L1385] s->init_num = 0 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1604] EXPR s->s3 [L1604] EXPR (s->s3)->tmp.reuse_message VAL [={6:-5}, (s->s3)->tmp.reuse_message=20535, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->s3={20502:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1604] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1633] skip = 0 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1130] COND TRUE 1 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4432, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1172] COND FALSE !(s->state == 4432) [L1175] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1175] COND FALSE !(s->state == 4433) [L1178] EXPR s->state VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=1, s={20498:0}, s={20498:0}, s->state=4448, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1178] COND TRUE s->state == 4448 [L1389] ret = __VERIFIER_nondet_int() [L1390] COND TRUE blastFlag == 4 VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=0, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1645] __VERIFIER_error() VAL [={6:-5}, blastFlag=4, buf={20507:20513}, init=1, malloc(sizeof(int))={20530:0}, ret=0, s={20498:0}, s={20498:0}, skip=0, SSLv3_client_data={20490:0}, state=4448, tmp=0, tmp___0={20530:0}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] - StatisticsResult: Ultimate Automizer benchmark data CFG has 4 procedures, 142 locations, 1 error locations. UNSAFE Result, 12.8s OverallTime, 35 OverallIterations, 7 TraceHistogramMax, 6.8s AutomataDifference, 0.0s DeadEndRemovalTime, 0.0s HoareAnnotationTime, HoareTripleCheckerStatistics: 7566 SDtfs, 2657 SDslu, 9982 SDs, 0 SdLazy, 5228 SolverSat, 203 SolverUnsat, 0 SolverUnknown, 0 SolverNotchecked, 4.9s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 208 GetRequests, 68 SyntacticMatches, 45 SemanticMatches, 95 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.7s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1029occurred in iteration=34, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 0.5s AutomataMinimizationTime, 34 MinimizatonAttempts, 2607 StatesRemovedByMinimization, 29 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TraceCheckStatistics: 0.1s SsaConstructionTime, 0.5s SatisfiabilityAnalysisTime, 1.3s InterpolantComputationTime, 3084 NumberOfCodeBlocks, 3084 NumberOfCodeBlocksAsserted, 35 NumberOfCheckSat, 2907 ConstructedInterpolants, 0 QuantifiedInterpolants, 612042 SizeOfPredicates, 0 NumberOfNonLiveVariables, 0 ConjunctsInSsa, 0 ConjunctsInUnsatCore, 34 InterpolantComputations, 34 PerfectInterpolantSequences, 2666/2666 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces Received shutdown request... ### Bit-precise run ### This is Ultimate 0.1.23-aa41828 [2018-11-23 09:55:00,664 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-23 09:55:00,665 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-23 09:55:00,672 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-23 09:55:00,672 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-23 09:55:00,673 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-23 09:55:00,674 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-23 09:55:00,675 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-23 09:55:00,676 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-23 09:55:00,676 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-23 09:55:00,677 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-23 09:55:00,677 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-23 09:55:00,678 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-23 09:55:00,679 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-23 09:55:00,679 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-23 09:55:00,680 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-23 09:55:00,681 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-23 09:55:00,683 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-23 09:55:00,684 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-23 09:55:00,685 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-23 09:55:00,686 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-23 09:55:00,687 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-23 09:55:00,688 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-23 09:55:00,688 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-23 09:55:00,689 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-23 09:55:00,689 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-23 09:55:00,690 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-23 09:55:00,690 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-23 09:55:00,691 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-23 09:55:00,692 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-23 09:55:00,692 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-23 09:55:00,692 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-23 09:55:00,692 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-23 09:55:00,692 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-23 09:55:00,694 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-23 09:55:00,694 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-23 09:55:00,695 INFO L98 SettingsManager]: Beginning loading settings from /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Bitvector.epf [2018-11-23 09:55:00,705 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-23 09:55:00,705 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-23 09:55:00,706 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-23 09:55:00,706 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-23 09:55:00,706 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-23 09:55:00,706 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-23 09:55:00,706 INFO L133 SettingsManager]: * Use SBE=true [2018-11-23 09:55:00,707 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-23 09:55:00,707 INFO L133 SettingsManager]: * sizeof long=4 [2018-11-23 09:55:00,707 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-11-23 09:55:00,707 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-23 09:55:00,707 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-23 09:55:00,707 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-23 09:55:00,707 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-23 09:55:00,708 INFO L133 SettingsManager]: * Use bitvectors instead of ints=true [2018-11-23 09:55:00,708 INFO L133 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2018-11-23 09:55:00,708 INFO L133 SettingsManager]: * sizeof long double=12 [2018-11-23 09:55:00,708 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-23 09:55:00,708 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-23 09:55:00,708 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-23 09:55:00,708 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-23 09:55:00,709 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-23 09:55:00,709 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-23 09:55:00,709 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-23 09:55:00,709 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 09:55:00,709 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-23 09:55:00,709 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-23 09:55:00,709 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-23 09:55:00,710 INFO L133 SettingsManager]: * Trace refinement strategy=WOLF [2018-11-23 09:55:00,710 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-23 09:55:00,710 INFO L133 SettingsManager]: * Command for external solver=cvc4nyu --tear-down-incremental --rewrite-divk --print-success --lang smt [2018-11-23 09:55:00,710 INFO L133 SettingsManager]: * Logic for external solver=AUFBV [2018-11-23 09:55:00,710 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 32bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> cdf0cf9bd7de1f69825d4535f203da45c4edbbfc [2018-11-23 09:55:00,738 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-23 09:55:00,746 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-23 09:55:00,748 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-23 09:55:00,749 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-23 09:55:00,749 INFO L276 PluginConnector]: CDTParser initialized [2018-11-23 09:55:00,750 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/../../sv-benchmarks/c/loops/s3_false-unreach-call.i [2018-11-23 09:55:00,785 INFO L221 CDTParser]: Created temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data/48e93a2a3/fbe6405c6de4449e98574836cee29846/FLAG5302d0b11 [2018-11-23 09:55:01,162 INFO L307 CDTParser]: Found 1 translation units. [2018-11-23 09:55:01,162 INFO L161 CDTParser]: Scanning /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/sv-benchmarks/c/loops/s3_false-unreach-call.i [2018-11-23 09:55:01,174 INFO L355 CDTParser]: About to delete temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data/48e93a2a3/fbe6405c6de4449e98574836cee29846/FLAG5302d0b11 [2018-11-23 09:55:01,543 INFO L363 CDTParser]: Successfully deleted /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/data/48e93a2a3/fbe6405c6de4449e98574836cee29846 [2018-11-23 09:55:01,545 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-23 09:55:01,546 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-23 09:55:01,547 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-23 09:55:01,547 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-23 09:55:01,550 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-23 09:55:01,550 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 09:55:01" (1/1) ... [2018-11-23 09:55:01,553 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@17c4c0b5 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:01, skipping insertion in model container [2018-11-23 09:55:01,553 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 09:55:01" (1/1) ... [2018-11-23 09:55:01,561 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-23 09:55:01,607 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-23 09:55:01,913 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 09:55:01,923 INFO L191 MainTranslator]: Completed pre-run [2018-11-23 09:55:02,052 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 09:55:02,068 INFO L195 MainTranslator]: Completed translation [2018-11-23 09:55:02,069 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02 WrapperNode [2018-11-23 09:55:02,069 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-23 09:55:02,069 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-23 09:55:02,069 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-23 09:55:02,070 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-23 09:55:02,076 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... [2018-11-23 09:55:02,094 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... [2018-11-23 09:55:02,102 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-23 09:55:02,102 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-23 09:55:02,102 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-23 09:55:02,102 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-23 09:55:02,110 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... [2018-11-23 09:55:02,110 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... [2018-11-23 09:55:02,116 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... [2018-11-23 09:55:02,116 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... [2018-11-23 09:55:02,148 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... [2018-11-23 09:55:02,154 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... [2018-11-23 09:55:02,157 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... [2018-11-23 09:55:02,161 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-23 09:55:02,162 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-23 09:55:02,162 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-23 09:55:02,162 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-23 09:55:02,163 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (1/1) ... No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 09:55:02,210 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-11-23 09:55:02,210 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2018-11-23 09:55:02,210 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-23 09:55:02,210 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-23 09:55:02,211 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE4 [2018-11-23 09:55:02,211 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-11-23 09:55:02,211 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-23 09:55:02,211 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-23 09:55:02,211 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-11-23 09:55:02,211 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2018-11-23 09:55:02,211 INFO L130 BoogieDeclarations]: Found specification of procedure ssl3_connect [2018-11-23 09:55:02,211 INFO L138 BoogieDeclarations]: Found implementation of procedure ssl3_connect [2018-11-23 09:55:02,212 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-23 09:55:02,212 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-23 09:55:02,212 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2018-11-23 09:55:02,400 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 09:55:02,401 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 09:55:04,037 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-23 09:55:04,037 INFO L280 CfgBuilder]: Removed 1 assue(true) statements. [2018-11-23 09:55:04,038 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 09:55:04 BoogieIcfgContainer [2018-11-23 09:55:04,038 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-23 09:55:04,039 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-23 09:55:04,039 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-23 09:55:04,042 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-23 09:55:04,042 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 23.11 09:55:01" (1/3) ... [2018-11-23 09:55:04,042 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@7cb986ae and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 09:55:04, skipping insertion in model container [2018-11-23 09:55:04,043 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 09:55:02" (2/3) ... [2018-11-23 09:55:04,043 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@7cb986ae and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 09:55:04, skipping insertion in model container [2018-11-23 09:55:04,043 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 09:55:04" (3/3) ... [2018-11-23 09:55:04,045 INFO L112 eAbstractionObserver]: Analyzing ICFG s3_false-unreach-call.i [2018-11-23 09:55:04,051 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-23 09:55:04,057 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-23 09:55:04,067 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-23 09:55:04,091 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-23 09:55:04,092 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-23 09:55:04,092 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-23 09:55:04,092 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-23 09:55:04,092 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-23 09:55:04,092 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-23 09:55:04,092 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-23 09:55:04,093 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-23 09:55:04,093 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-23 09:55:04,108 INFO L276 IsEmpty]: Start isEmpty. Operand 140 states. [2018-11-23 09:55:04,114 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 31 [2018-11-23 09:55:04,114 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:04,115 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:04,117 INFO L423 AbstractCegarLoop]: === Iteration 1 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:04,120 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:04,121 INFO L82 PathProgramCache]: Analyzing trace with hash -1513562951, now seen corresponding path program 1 times [2018-11-23 09:55:04,124 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:04,125 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:04,141 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:55:04,227 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:55:04,237 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:04,284 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 09:55:04,284 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 09:55:04,290 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:04,290 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:55:04,294 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:55:04,305 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:55:04,306 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:04,308 INFO L87 Difference]: Start difference. First operand 140 states. Second operand 3 states. [2018-11-23 09:55:04,395 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:04,395 INFO L93 Difference]: Finished difference Result 385 states and 637 transitions. [2018-11-23 09:55:04,396 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:55:04,397 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 30 [2018-11-23 09:55:04,398 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:04,409 INFO L225 Difference]: With dead ends: 385 [2018-11-23 09:55:04,409 INFO L226 Difference]: Without dead ends: 223 [2018-11-23 09:55:04,412 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 29 GetRequests, 28 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:04,429 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 223 states. [2018-11-23 09:55:04,458 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 223 to 223. [2018-11-23 09:55:04,459 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 223 states. [2018-11-23 09:55:04,462 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 223 states to 223 states and 327 transitions. [2018-11-23 09:55:04,464 INFO L78 Accepts]: Start accepts. Automaton has 223 states and 327 transitions. Word has length 30 [2018-11-23 09:55:04,464 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:04,464 INFO L480 AbstractCegarLoop]: Abstraction has 223 states and 327 transitions. [2018-11-23 09:55:04,464 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:55:04,464 INFO L276 IsEmpty]: Start isEmpty. Operand 223 states and 327 transitions. [2018-11-23 09:55:04,466 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 46 [2018-11-23 09:55:04,466 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:04,467 INFO L402 BasicCegarLoop]: trace histogram [2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:04,467 INFO L423 AbstractCegarLoop]: === Iteration 2 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:04,467 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:04,468 INFO L82 PathProgramCache]: Analyzing trace with hash -959560751, now seen corresponding path program 1 times [2018-11-23 09:55:04,468 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:04,468 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:04,498 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:55:04,578 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:55:04,585 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:04,617 INFO L134 CoverageAnalysis]: Checked inductivity of 8 backedges. 8 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 09:55:04,617 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [MP cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (3)] Exception during sending of exit command (exit): Broken pipe [2018-11-23 09:55:04,621 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:04,621 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:55:04,622 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:55:04,623 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:55:04,623 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:04,623 INFO L87 Difference]: Start difference. First operand 223 states and 327 transitions. Second operand 3 states. [2018-11-23 09:55:04,840 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:04,840 INFO L93 Difference]: Finished difference Result 432 states and 642 transitions. [2018-11-23 09:55:04,840 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:55:04,841 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-23 09:55:04,841 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:04,843 INFO L225 Difference]: With dead ends: 432 [2018-11-23 09:55:04,843 INFO L226 Difference]: Without dead ends: 325 [2018-11-23 09:55:04,844 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 44 GetRequests, 43 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:04,846 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 325 states. [2018-11-23 09:55:04,862 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 325 to 325. [2018-11-23 09:55:04,862 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 325 states. [2018-11-23 09:55:04,864 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 325 states to 325 states and 476 transitions. [2018-11-23 09:55:04,865 INFO L78 Accepts]: Start accepts. Automaton has 325 states and 476 transitions. Word has length 45 [2018-11-23 09:55:04,865 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:04,865 INFO L480 AbstractCegarLoop]: Abstraction has 325 states and 476 transitions. [2018-11-23 09:55:04,865 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:55:04,865 INFO L276 IsEmpty]: Start isEmpty. Operand 325 states and 476 transitions. [2018-11-23 09:55:04,868 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-23 09:55:04,868 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:04,868 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:04,868 INFO L423 AbstractCegarLoop]: === Iteration 3 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:04,868 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:04,869 INFO L82 PathProgramCache]: Analyzing trace with hash -1822634295, now seen corresponding path program 1 times [2018-11-23 09:55:04,869 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:04,869 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:04,894 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:55:04,992 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:55:04,999 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:05,016 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 09:55:05,016 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 09:55:05,018 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:05,018 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:55:05,019 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:55:05,019 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:55:05,019 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:05,019 INFO L87 Difference]: Start difference. First operand 325 states and 476 transitions. Second operand 3 states. [2018-11-23 09:55:05,106 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:05,106 INFO L93 Difference]: Finished difference Result 638 states and 943 transitions. [2018-11-23 09:55:05,113 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:55:05,113 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 63 [2018-11-23 09:55:05,114 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:05,115 INFO L225 Difference]: With dead ends: 638 [2018-11-23 09:55:05,115 INFO L226 Difference]: Without dead ends: 429 [2018-11-23 09:55:05,116 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 62 GetRequests, 61 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:05,117 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 429 states. [2018-11-23 09:55:05,132 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 429 to 429. [2018-11-23 09:55:05,132 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 429 states. [2018-11-23 09:55:05,133 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 429 states to 429 states and 628 transitions. [2018-11-23 09:55:05,133 INFO L78 Accepts]: Start accepts. Automaton has 429 states and 628 transitions. Word has length 63 [2018-11-23 09:55:05,134 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:05,134 INFO L480 AbstractCegarLoop]: Abstraction has 429 states and 628 transitions. [2018-11-23 09:55:05,134 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:55:05,134 INFO L276 IsEmpty]: Start isEmpty. Operand 429 states and 628 transitions. [2018-11-23 09:55:05,136 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 84 [2018-11-23 09:55:05,137 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:05,137 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:05,137 INFO L423 AbstractCegarLoop]: === Iteration 4 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:05,137 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:05,137 INFO L82 PathProgramCache]: Analyzing trace with hash -1221318135, now seen corresponding path program 1 times [2018-11-23 09:55:05,138 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:05,138 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:05,156 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:55:05,249 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:55:05,255 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:05,279 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 29 trivial. 0 not checked. [2018-11-23 09:55:05,279 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 09:55:05,281 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:05,281 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:55:05,281 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:55:05,281 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:55:05,282 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:05,282 INFO L87 Difference]: Start difference. First operand 429 states and 628 transitions. Second operand 3 states. [2018-11-23 09:55:05,364 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:05,365 INFO L93 Difference]: Finished difference Result 845 states and 1246 transitions. [2018-11-23 09:55:05,365 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:55:05,365 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 83 [2018-11-23 09:55:05,366 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:05,368 INFO L225 Difference]: With dead ends: 845 [2018-11-23 09:55:05,368 INFO L226 Difference]: Without dead ends: 532 [2018-11-23 09:55:05,370 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 82 GetRequests, 81 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:05,371 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 532 states. [2018-11-23 09:55:05,383 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 532 to 532. [2018-11-23 09:55:05,383 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 532 states. [2018-11-23 09:55:05,385 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 532 states to 532 states and 779 transitions. [2018-11-23 09:55:05,386 INFO L78 Accepts]: Start accepts. Automaton has 532 states and 779 transitions. Word has length 83 [2018-11-23 09:55:05,386 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:05,386 INFO L480 AbstractCegarLoop]: Abstraction has 532 states and 779 transitions. [2018-11-23 09:55:05,386 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:55:05,386 INFO L276 IsEmpty]: Start isEmpty. Operand 532 states and 779 transitions. [2018-11-23 09:55:05,388 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 105 [2018-11-23 09:55:05,388 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:05,388 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:05,389 INFO L423 AbstractCegarLoop]: === Iteration 5 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:05,389 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:05,389 INFO L82 PathProgramCache]: Analyzing trace with hash -1674718222, now seen corresponding path program 1 times [2018-11-23 09:55:05,389 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:05,390 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:05,407 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:55:05,501 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:55:05,507 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:05,522 INFO L134 CoverageAnalysis]: Checked inductivity of 118 backedges. 53 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 09:55:05,522 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 09:55:05,524 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:05,524 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 09:55:05,524 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 09:55:05,524 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 09:55:05,524 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:05,525 INFO L87 Difference]: Start difference. First operand 532 states and 779 transitions. Second operand 3 states. [2018-11-23 09:55:05,696 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:05,696 INFO L93 Difference]: Finished difference Result 945 states and 1387 transitions. [2018-11-23 09:55:05,697 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 09:55:05,697 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 104 [2018-11-23 09:55:05,698 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:05,699 INFO L225 Difference]: With dead ends: 945 [2018-11-23 09:55:05,700 INFO L226 Difference]: Without dead ends: 529 [2018-11-23 09:55:05,701 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 103 GetRequests, 102 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 09:55:05,701 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 529 states. [2018-11-23 09:55:05,714 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 529 to 529. [2018-11-23 09:55:05,714 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 529 states. [2018-11-23 09:55:05,716 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 529 states to 529 states and 769 transitions. [2018-11-23 09:55:05,716 INFO L78 Accepts]: Start accepts. Automaton has 529 states and 769 transitions. Word has length 104 [2018-11-23 09:55:05,717 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:05,717 INFO L480 AbstractCegarLoop]: Abstraction has 529 states and 769 transitions. [2018-11-23 09:55:05,717 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 09:55:05,717 INFO L276 IsEmpty]: Start isEmpty. Operand 529 states and 769 transitions. [2018-11-23 09:55:05,719 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 107 [2018-11-23 09:55:05,719 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:05,719 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:05,719 INFO L423 AbstractCegarLoop]: === Iteration 6 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:05,719 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:05,719 INFO L82 PathProgramCache]: Analyzing trace with hash 1067312749, now seen corresponding path program 1 times [2018-11-23 09:55:05,735 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:05,735 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:05,753 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:55:06,037 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:55:06,139 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:06,321 WARN L180 SmtUtils]: Spent 149.00 ms on a formula simplification that was a NOOP. DAG size: 30 [2018-11-23 09:55:06,356 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 31 treesize of output 31 [2018-11-23 09:55:06,363 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 18 [2018-11-23 09:55:06,368 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,371 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 27 [2018-11-23 09:55:06,372 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,381 INFO L267 ElimStorePlain]: Start of recursive call 3: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,408 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 31 [2018-11-23 09:55:06,411 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 8 treesize of output 7 [2018-11-23 09:55:06,412 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,421 INFO L267 ElimStorePlain]: Start of recursive call 5: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,430 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,439 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 40 treesize of output 38 [2018-11-23 09:55:06,446 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 35 treesize of output 32 [2018-11-23 09:55:06,455 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,461 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 32 treesize of output 38 [2018-11-23 09:55:06,461 INFO L267 ElimStorePlain]: Start of recursive call 9: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,481 INFO L267 ElimStorePlain]: Start of recursive call 8: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,506 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 26 [2018-11-23 09:55:06,511 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,515 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,518 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,523 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,528 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 4 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 23 treesize of output 56 [2018-11-23 09:55:06,528 INFO L267 ElimStorePlain]: Start of recursive call 11: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,541 INFO L267 ElimStorePlain]: Start of recursive call 10: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,551 INFO L267 ElimStorePlain]: Start of recursive call 7: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,571 INFO L267 ElimStorePlain]: Start of recursive call 1: 2 dim-0 vars, 1 dim-2 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:06,571 INFO L202 ElimStorePlain]: Needed 11 recursive calls to eliminate 3 variables, input treesize:45, output treesize:20 [2018-11-23 09:55:06,608 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,647 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 3 case distinctions, treesize of input 40 treesize of output 62 [2018-11-23 09:55:06,654 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,661 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,665 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 51 treesize of output 48 [2018-11-23 09:55:06,666 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,728 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,730 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,732 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,737 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,744 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,748 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 3 select indices, 3 select index equivalence classes, 5 disjoint index pairs (out of 3 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 34 treesize of output 73 [2018-11-23 09:55:06,748 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,760 INFO L267 ElimStorePlain]: Start of recursive call 2: 2 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,767 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:06,767 INFO L202 ElimStorePlain]: Needed 4 recursive calls to eliminate 2 variables, input treesize:43, output treesize:22 [2018-11-23 09:55:06,794 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 2 select indices, 2 select index equivalence classes, 0 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 1 case distinctions, treesize of input 22 treesize of output 24 [2018-11-23 09:55:06,797 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 8 [2018-11-23 09:55:06,798 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,811 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:06,811 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 16 treesize of output 8 [2018-11-23 09:55:06,812 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,819 INFO L267 ElimStorePlain]: Start of recursive call 2: 2 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,820 INFO L267 ElimStorePlain]: Start of recursive call 1: 2 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:06,821 INFO L202 ElimStorePlain]: Needed 4 recursive calls to eliminate 3 variables, input treesize:22, output treesize:3 [2018-11-23 09:55:06,838 INFO L134 CoverageAnalysis]: Checked inductivity of 118 backedges. 32 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-23 09:55:06,839 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 09:55:06,841 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:06,841 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2018-11-23 09:55:06,841 INFO L459 AbstractCegarLoop]: Interpolant automaton has 6 states [2018-11-23 09:55:06,842 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2018-11-23 09:55:06,842 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=9, Invalid=21, Unknown=0, NotChecked=0, Total=30 [2018-11-23 09:55:06,842 INFO L87 Difference]: Start difference. First operand 529 states and 769 transitions. Second operand 6 states. [2018-11-23 09:55:11,111 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:11,111 INFO L93 Difference]: Finished difference Result 1028 states and 1496 transitions. [2018-11-23 09:55:11,113 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 6 states. [2018-11-23 09:55:11,113 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 106 [2018-11-23 09:55:11,113 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:11,115 INFO L225 Difference]: With dead ends: 1028 [2018-11-23 09:55:11,115 INFO L226 Difference]: Without dead ends: 613 [2018-11-23 09:55:11,116 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 107 GetRequests, 100 SyntacticMatches, 1 SemanticMatches, 6 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=19, Invalid=37, Unknown=0, NotChecked=0, Total=56 [2018-11-23 09:55:11,117 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 613 states. [2018-11-23 09:55:11,134 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 613 to 537. [2018-11-23 09:55:11,134 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 537 states. [2018-11-23 09:55:11,136 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 537 states to 537 states and 782 transitions. [2018-11-23 09:55:11,136 INFO L78 Accepts]: Start accepts. Automaton has 537 states and 782 transitions. Word has length 106 [2018-11-23 09:55:11,136 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:11,137 INFO L480 AbstractCegarLoop]: Abstraction has 537 states and 782 transitions. [2018-11-23 09:55:11,137 INFO L481 AbstractCegarLoop]: Interpolant automaton has 6 states. [2018-11-23 09:55:11,137 INFO L276 IsEmpty]: Start isEmpty. Operand 537 states and 782 transitions. [2018-11-23 09:55:11,138 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 108 [2018-11-23 09:55:11,138 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:11,139 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:11,139 INFO L423 AbstractCegarLoop]: === Iteration 7 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:11,139 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:11,139 INFO L82 PathProgramCache]: Analyzing trace with hash 534436016, now seen corresponding path program 1 times [2018-11-23 09:55:11,139 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:11,140 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:11,158 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:55:11,584 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:55:11,684 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:11,877 WARN L180 SmtUtils]: Spent 155.00 ms on a formula simplification that was a NOOP. DAG size: 30 [2018-11-23 09:55:11,892 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 40 treesize of output 38 [2018-11-23 09:55:11,898 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 35 treesize of output 32 [2018-11-23 09:55:11,906 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:11,912 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 32 treesize of output 38 [2018-11-23 09:55:11,913 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:11,931 INFO L267 ElimStorePlain]: Start of recursive call 3: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:11,955 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 26 [2018-11-23 09:55:11,960 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:11,961 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:11,963 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:11,968 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:11,972 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 4 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 23 treesize of output 56 [2018-11-23 09:55:11,973 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:11,987 INFO L267 ElimStorePlain]: Start of recursive call 5: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:11,999 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,029 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 31 treesize of output 31 [2018-11-23 09:55:12,033 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 18 [2018-11-23 09:55:12,038 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,043 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 27 [2018-11-23 09:55:12,043 INFO L267 ElimStorePlain]: Start of recursive call 9: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,054 INFO L267 ElimStorePlain]: Start of recursive call 8: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,080 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 31 [2018-11-23 09:55:12,083 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 8 treesize of output 7 [2018-11-23 09:55:12,084 INFO L267 ElimStorePlain]: Start of recursive call 11: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,096 INFO L267 ElimStorePlain]: Start of recursive call 10: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,107 INFO L267 ElimStorePlain]: Start of recursive call 7: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,138 INFO L267 ElimStorePlain]: Start of recursive call 1: 2 dim-0 vars, 1 dim-2 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:12,138 INFO L202 ElimStorePlain]: Needed 11 recursive calls to eliminate 3 variables, input treesize:45, output treesize:20 [2018-11-23 09:55:12,167 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,218 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 3 case distinctions, treesize of input 40 treesize of output 62 [2018-11-23 09:55:12,223 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,230 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,231 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 51 treesize of output 48 [2018-11-23 09:55:12,232 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,285 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,287 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,293 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,296 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,301 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,304 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 3 select indices, 3 select index equivalence classes, 5 disjoint index pairs (out of 3 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 34 treesize of output 73 [2018-11-23 09:55:12,305 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,321 INFO L267 ElimStorePlain]: Start of recursive call 2: 2 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,329 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:12,330 INFO L202 ElimStorePlain]: Needed 4 recursive calls to eliminate 2 variables, input treesize:43, output treesize:22 [2018-11-23 09:55:12,358 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 2 select indices, 2 select index equivalence classes, 0 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 1 case distinctions, treesize of input 22 treesize of output 24 [2018-11-23 09:55:12,365 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:12,366 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 16 treesize of output 8 [2018-11-23 09:55:12,366 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,377 INFO L267 ElimStorePlain]: Start of recursive call 2: 2 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,378 INFO L267 ElimStorePlain]: Start of recursive call 1: 2 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:12,378 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 3 variables, input treesize:22, output treesize:3 [2018-11-23 09:55:12,396 INFO L134 CoverageAnalysis]: Checked inductivity of 122 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-23 09:55:12,396 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 09:55:12,399 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:12,399 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2018-11-23 09:55:12,399 INFO L459 AbstractCegarLoop]: Interpolant automaton has 6 states [2018-11-23 09:55:12,399 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2018-11-23 09:55:12,399 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=9, Invalid=21, Unknown=0, NotChecked=0, Total=30 [2018-11-23 09:55:12,400 INFO L87 Difference]: Start difference. First operand 537 states and 782 transitions. Second operand 6 states. [2018-11-23 09:55:16,622 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:16,622 INFO L93 Difference]: Finished difference Result 1025 states and 1492 transitions. [2018-11-23 09:55:16,623 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 6 states. [2018-11-23 09:55:16,624 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 107 [2018-11-23 09:55:16,624 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:16,626 INFO L225 Difference]: With dead ends: 1025 [2018-11-23 09:55:16,626 INFO L226 Difference]: Without dead ends: 610 [2018-11-23 09:55:16,627 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 108 GetRequests, 101 SyntacticMatches, 1 SemanticMatches, 6 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=19, Invalid=37, Unknown=0, NotChecked=0, Total=56 [2018-11-23 09:55:16,628 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 610 states. [2018-11-23 09:55:16,643 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 610 to 538. [2018-11-23 09:55:16,643 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 538 states. [2018-11-23 09:55:16,645 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 538 states to 538 states and 783 transitions. [2018-11-23 09:55:16,645 INFO L78 Accepts]: Start accepts. Automaton has 538 states and 783 transitions. Word has length 107 [2018-11-23 09:55:16,645 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:16,646 INFO L480 AbstractCegarLoop]: Abstraction has 538 states and 783 transitions. [2018-11-23 09:55:16,646 INFO L481 AbstractCegarLoop]: Interpolant automaton has 6 states. [2018-11-23 09:55:16,646 INFO L276 IsEmpty]: Start isEmpty. Operand 538 states and 783 transitions. [2018-11-23 09:55:16,647 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 122 [2018-11-23 09:55:16,647 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:16,647 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:16,648 INFO L423 AbstractCegarLoop]: === Iteration 8 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:16,648 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:16,648 INFO L82 PathProgramCache]: Analyzing trace with hash -48734010, now seen corresponding path program 1 times [2018-11-23 09:55:16,648 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:16,648 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:16,673 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:55:20,027 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:55:20,484 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:20,507 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 15 [2018-11-23 09:55:20,510 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 18 [2018-11-23 09:55:20,516 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:20,518 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:20,518 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 2 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 37 [2018-11-23 09:55:20,519 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:20,529 INFO L267 ElimStorePlain]: Start of recursive call 3: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:20,538 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:20,547 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:20,547 INFO L202 ElimStorePlain]: Needed 4 recursive calls to eliminate 1 variables, input treesize:22, output treesize:22 [2018-11-23 09:55:20,569 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 22 treesize of output 16 [2018-11-23 09:55:20,571 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:20,572 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 16 treesize of output 8 [2018-11-23 09:55:20,573 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:20,580 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:20,581 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:20,581 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 2 variables, input treesize:22, output treesize:3 [2018-11-23 09:55:20,608 INFO L134 CoverageAnalysis]: Checked inductivity of 145 backedges. 59 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-23 09:55:20,608 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 09:55:20,612 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:20,612 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [7] imperfect sequences [] total 7 [2018-11-23 09:55:20,612 INFO L459 AbstractCegarLoop]: Interpolant automaton has 7 states [2018-11-23 09:55:20,613 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 7 interpolants. [2018-11-23 09:55:20,613 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2018-11-23 09:55:20,613 INFO L87 Difference]: Start difference. First operand 538 states and 783 transitions. Second operand 7 states. [2018-11-23 09:55:28,485 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:28,485 INFO L93 Difference]: Finished difference Result 1420 states and 2074 transitions. [2018-11-23 09:55:28,488 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 7 states. [2018-11-23 09:55:28,488 INFO L78 Accepts]: Start accepts. Automaton has 7 states. Word has length 121 [2018-11-23 09:55:28,488 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:28,491 INFO L225 Difference]: With dead ends: 1420 [2018-11-23 09:55:28,491 INFO L226 Difference]: Without dead ends: 904 [2018-11-23 09:55:28,493 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 123 GetRequests, 115 SyntacticMatches, 0 SemanticMatches, 8 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=30, Invalid=60, Unknown=0, NotChecked=0, Total=90 [2018-11-23 09:55:28,494 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 904 states. [2018-11-23 09:55:28,516 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 904 to 642. [2018-11-23 09:55:28,516 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 642 states. [2018-11-23 09:55:28,518 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 642 states to 642 states and 967 transitions. [2018-11-23 09:55:28,519 INFO L78 Accepts]: Start accepts. Automaton has 642 states and 967 transitions. Word has length 121 [2018-11-23 09:55:28,519 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:28,519 INFO L480 AbstractCegarLoop]: Abstraction has 642 states and 967 transitions. [2018-11-23 09:55:28,519 INFO L481 AbstractCegarLoop]: Interpolant automaton has 7 states. [2018-11-23 09:55:28,519 INFO L276 IsEmpty]: Start isEmpty. Operand 642 states and 967 transitions. [2018-11-23 09:55:28,521 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 123 [2018-11-23 09:55:28,521 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:28,521 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:28,521 INFO L423 AbstractCegarLoop]: === Iteration 9 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:28,521 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:28,521 INFO L82 PathProgramCache]: Analyzing trace with hash -1515231419, now seen corresponding path program 1 times [2018-11-23 09:55:28,522 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:28,522 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 10 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 10 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:28,541 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 09:55:31,969 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 09:55:32,425 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:32,450 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 15 [2018-11-23 09:55:32,453 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 18 [2018-11-23 09:55:32,458 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:32,459 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:32,460 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 2 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 37 [2018-11-23 09:55:32,460 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:32,467 INFO L267 ElimStorePlain]: Start of recursive call 3: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:32,471 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:32,479 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:32,479 INFO L202 ElimStorePlain]: Needed 4 recursive calls to eliminate 1 variables, input treesize:22, output treesize:22 [2018-11-23 09:55:32,498 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 22 treesize of output 16 [2018-11-23 09:55:32,500 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:32,500 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 16 treesize of output 8 [2018-11-23 09:55:32,501 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:32,504 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:32,505 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:32,505 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 2 variables, input treesize:22, output treesize:3 [2018-11-23 09:55:32,526 INFO L134 CoverageAnalysis]: Checked inductivity of 145 backedges. 59 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-23 09:55:32,526 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 09:55:32,530 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:32,530 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [7] imperfect sequences [] total 7 [2018-11-23 09:55:32,530 INFO L459 AbstractCegarLoop]: Interpolant automaton has 7 states [2018-11-23 09:55:32,530 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 7 interpolants. [2018-11-23 09:55:32,531 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2018-11-23 09:55:32,531 INFO L87 Difference]: Start difference. First operand 642 states and 967 transitions. Second operand 7 states. [2018-11-23 09:55:40,588 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:40,588 INFO L93 Difference]: Finished difference Result 1508 states and 2236 transitions. [2018-11-23 09:55:40,590 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 7 states. [2018-11-23 09:55:40,591 INFO L78 Accepts]: Start accepts. Automaton has 7 states. Word has length 122 [2018-11-23 09:55:40,591 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:40,593 INFO L225 Difference]: With dead ends: 1508 [2018-11-23 09:55:40,594 INFO L226 Difference]: Without dead ends: 888 [2018-11-23 09:55:40,595 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 124 GetRequests, 116 SyntacticMatches, 0 SemanticMatches, 8 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=30, Invalid=60, Unknown=0, NotChecked=0, Total=90 [2018-11-23 09:55:40,596 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 888 states. [2018-11-23 09:55:40,620 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 888 to 646. [2018-11-23 09:55:40,620 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 646 states. [2018-11-23 09:55:40,622 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 646 states to 646 states and 971 transitions. [2018-11-23 09:55:40,622 INFO L78 Accepts]: Start accepts. Automaton has 646 states and 971 transitions. Word has length 122 [2018-11-23 09:55:40,622 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:40,622 INFO L480 AbstractCegarLoop]: Abstraction has 646 states and 971 transitions. [2018-11-23 09:55:40,622 INFO L481 AbstractCegarLoop]: Interpolant automaton has 7 states. [2018-11-23 09:55:40,622 INFO L276 IsEmpty]: Start isEmpty. Operand 646 states and 971 transitions. [2018-11-23 09:55:40,624 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 137 [2018-11-23 09:55:40,624 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 09:55:40,624 INFO L402 BasicCegarLoop]: trace histogram [7, 7, 6, 6, 6, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 09:55:40,624 INFO L423 AbstractCegarLoop]: === Iteration 10 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 09:55:40,625 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 09:55:40,625 INFO L82 PathProgramCache]: Analyzing trace with hash -1330335365, now seen corresponding path program 2 times [2018-11-23 09:55:40,625 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 09:55:40,625 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/cvc4nyu Starting monitored process 11 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 11 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 09:55:40,643 INFO L101 rtionOrderModulation]: Changing assertion order to OUTSIDE_LOOP_FIRST1 [2018-11-23 09:55:41,224 INFO L249 tOrderPrioritization]: Assert order OUTSIDE_LOOP_FIRST1 issued 2 check-sat command(s) [2018-11-23 09:55:41,224 INFO L250 tOrderPrioritization]: Conjunction of SSA is unsat [2018-11-23 09:55:41,406 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 09:55:41,691 WARN L180 SmtUtils]: Spent 262.00 ms on a formula simplification that was a NOOP. DAG size: 52 [2018-11-23 09:55:41,700 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 160 treesize of output 152 [2018-11-23 09:55:41,709 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 141 treesize of output 125 [2018-11-23 09:55:41,709 INFO L267 ElimStorePlain]: Start of recursive call 3: 1 dim-0 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:41,760 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:41,763 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 130 treesize of output 124 [2018-11-23 09:55:41,768 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 115 treesize of output 97 [2018-11-23 09:55:41,768 INFO L267 ElimStorePlain]: Start of recursive call 5: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:41,792 INFO L267 ElimStorePlain]: Start of recursive call 4: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:41,800 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 162 treesize of output 152 [2018-11-23 09:55:41,807 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 152 treesize of output 132 [2018-11-23 09:55:41,808 INFO L267 ElimStorePlain]: Start of recursive call 7: 1 dim-0 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:41,850 INFO L267 ElimStorePlain]: Start of recursive call 6: 1 dim-1 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:43,035 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 136 treesize of output 122 [2018-11-23 09:55:43,045 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 122 treesize of output 94 [2018-11-23 09:55:43,046 INFO L267 ElimStorePlain]: Start of recursive call 9: 1 dim-0 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:43,088 INFO L267 ElimStorePlain]: Start of recursive call 8: 1 dim-1 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:43,095 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 132 treesize of output 120 [2018-11-23 09:55:43,102 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 113 treesize of output 89 [2018-11-23 09:55:43,103 INFO L267 ElimStorePlain]: Start of recursive call 11: 1 dim-0 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:43,143 INFO L267 ElimStorePlain]: Start of recursive call 10: 1 dim-1 vars, End of recursive call: 1 dim-0 vars, and 1 xjuncts. [2018-11-23 09:55:43,147 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 107 treesize of output 97 [2018-11-23 09:55:43,152 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 97 treesize of output 18 [2018-11-23 09:55:43,152 INFO L267 ElimStorePlain]: Start of recursive call 13: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:43,156 INFO L267 ElimStorePlain]: Start of recursive call 12: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:44,260 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 94 treesize of output 64 [2018-11-23 09:55:44,266 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 10 treesize of output 9 [2018-11-23 09:55:44,266 INFO L267 ElimStorePlain]: Start of recursive call 15: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:44,331 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:44,341 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 59 treesize of output 57 [2018-11-23 09:55:44,347 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:44,347 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 31 treesize of output 18 [2018-11-23 09:55:44,348 INFO L267 ElimStorePlain]: Start of recursive call 17: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:44,368 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 23 treesize of output 18 [2018-11-23 09:55:44,373 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:44,375 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:44,375 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 2 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 37 [2018-11-23 09:55:44,376 INFO L267 ElimStorePlain]: Start of recursive call 19: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:44,384 INFO L267 ElimStorePlain]: Start of recursive call 18: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:44,390 INFO L267 ElimStorePlain]: Start of recursive call 16: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:44,398 INFO L267 ElimStorePlain]: Start of recursive call 14: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:44,577 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 0 disjoint index pairs (out of 1 index pairs), introduced 3 new quantified variables, introduced 3 case distinctions, treesize of input 96 treesize of output 79 [2018-11-23 09:55:44,595 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:44,607 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 65 treesize of output 76 [2018-11-23 09:55:44,608 INFO L267 ElimStorePlain]: Start of recursive call 21: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:46,454 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 70 treesize of output 69 [2018-11-23 09:55:46,454 INFO L267 ElimStorePlain]: Start of recursive call 22: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:48,015 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:48,016 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 69 treesize of output 63 [2018-11-23 09:55:48,022 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:48,023 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 31 treesize of output 18 [2018-11-23 09:55:48,024 INFO L267 ElimStorePlain]: Start of recursive call 24: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:48,045 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 23 treesize of output 18 [2018-11-23 09:55:48,050 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:48,051 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:48,052 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 2 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 37 [2018-11-23 09:55:48,052 INFO L267 ElimStorePlain]: Start of recursive call 26: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:48,059 INFO L267 ElimStorePlain]: Start of recursive call 25: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:48,076 INFO L267 ElimStorePlain]: Start of recursive call 23: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:48,711 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:48,770 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 3 new quantified variables, introduced 3 case distinctions, treesize of input 67 treesize of output 77 [2018-11-23 09:55:48,780 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:48,796 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:48,797 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 50 treesize of output 53 [2018-11-23 09:55:48,798 INFO L267 ElimStorePlain]: Start of recursive call 28: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:49,331 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 51 treesize of output 50 [2018-11-23 09:55:49,332 INFO L267 ElimStorePlain]: Start of recursive call 29: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:49,837 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:49,841 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:49,853 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 53 treesize of output 54 [2018-11-23 09:55:49,864 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:49,868 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:49,872 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:49,881 INFO L683 Elim1Store]: detected equality via solver [2018-11-23 09:55:49,906 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:49,916 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:50,024 INFO L478 Elim1Store]: Elim1 applied some preprocessing eliminated variable of array dimension 1, 2 stores, 3 select indices, 3 select index equivalence classes, 5 disjoint index pairs (out of 3 index pairs), introduced 2 new quantified variables, introduced 4 case distinctions, treesize of input 42 treesize of output 94 [2018-11-23 09:55:50,025 INFO L267 ElimStorePlain]: Start of recursive call 31: End of recursive call: and 2 xjuncts. [2018-11-23 09:55:50,077 INFO L267 ElimStorePlain]: Start of recursive call 30: 1 dim-1 vars, End of recursive call: and 2 xjuncts. [2018-11-23 09:55:50,278 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:50,282 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:50,292 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 50 treesize of output 53 [2018-11-23 09:55:50,311 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:50,314 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:50,343 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:50,570 INFO L478 Elim1Store]: Elim1 applied some preprocessing eliminated variable of array dimension 1, 1 stores, 3 select indices, 3 select index equivalence classes, 4 disjoint index pairs (out of 3 index pairs), introduced 2 new quantified variables, introduced 6 case distinctions, treesize of input 41 treesize of output 111 [2018-11-23 09:55:50,573 INFO L267 ElimStorePlain]: Start of recursive call 33: 4 dim-0 vars, End of recursive call: 4 dim-0 vars, and 8 xjuncts. [2018-11-23 09:55:50,677 INFO L267 ElimStorePlain]: Start of recursive call 32: 1 dim-1 vars, End of recursive call: and 2 xjuncts. [2018-11-23 09:55:50,789 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 0 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 36 treesize of output 31 [2018-11-23 09:55:50,793 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:50,795 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:50,795 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 2 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 20 treesize of output 39 [2018-11-23 09:55:50,796 INFO L267 ElimStorePlain]: Start of recursive call 35: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:50,807 INFO L267 ElimStorePlain]: Start of recursive call 34: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:50,879 INFO L267 ElimStorePlain]: Start of recursive call 27: 2 dim-1 vars, 3 dim-2 vars, End of recursive call: and 5 xjuncts. [2018-11-23 09:55:51,063 INFO L267 ElimStorePlain]: Start of recursive call 20: 2 dim-1 vars, 3 dim-2 vars, End of recursive call: and 3 xjuncts. [2018-11-23 09:55:51,069 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 15 [2018-11-23 09:55:51,071 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 18 [2018-11-23 09:55:51,074 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:51,075 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:51,075 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 2 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 37 [2018-11-23 09:55:51,075 INFO L267 ElimStorePlain]: Start of recursive call 38: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:51,082 INFO L267 ElimStorePlain]: Start of recursive call 37: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:51,086 INFO L267 ElimStorePlain]: Start of recursive call 36: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:51,158 INFO L267 ElimStorePlain]: Start of recursive call 1: 3 dim-2 vars, End of recursive call: 3 dim-0 vars, and 4 xjuncts. [2018-11-23 09:55:51,158 INFO L202 ElimStorePlain]: Needed 38 recursive calls to eliminate 3 variables, input treesize:173, output treesize:118 [2018-11-23 09:55:51,288 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 22 treesize of output 16 [2018-11-23 09:55:51,290 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:51,291 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 16 treesize of output 8 [2018-11-23 09:55:51,291 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:51,293 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:51,313 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 2 select indices, 2 select index equivalence classes, 0 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 1 case distinctions, treesize of input 24 treesize of output 26 [2018-11-23 09:55:51,317 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 4 [2018-11-23 09:55:51,317 INFO L267 ElimStorePlain]: Start of recursive call 5: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:51,327 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 09:55:51,328 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 10 [2018-11-23 09:55:51,328 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 1 xjuncts. [2018-11-23 09:55:51,334 INFO L267 ElimStorePlain]: Start of recursive call 4: 2 dim-1 vars, End of recursive call: and 2 xjuncts. [2018-11-23 09:55:51,339 INFO L267 ElimStorePlain]: Start of recursive call 1: 3 dim-0 vars, 2 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 09:55:51,340 INFO L202 ElimStorePlain]: Needed 6 recursive calls to eliminate 5 variables, input treesize:47, output treesize:1 [2018-11-23 09:55:51,360 INFO L134 CoverageAnalysis]: Checked inductivity of 187 backedges. 65 proven. 0 refuted. 0 times theorem prover too weak. 122 trivial. 0 not checked. [2018-11-23 09:55:51,360 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 09:55:51,363 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 09:55:51,363 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2018-11-23 09:55:51,363 INFO L459 AbstractCegarLoop]: Interpolant automaton has 6 states [2018-11-23 09:55:51,363 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2018-11-23 09:55:51,364 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=10, Invalid=20, Unknown=0, NotChecked=0, Total=30 [2018-11-23 09:55:51,364 INFO L87 Difference]: Start difference. First operand 646 states and 971 transitions. Second operand 6 states. [2018-11-23 09:55:57,191 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 09:55:57,192 INFO L93 Difference]: Finished difference Result 1100 states and 1643 transitions. [2018-11-23 09:55:57,194 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 6 states. [2018-11-23 09:55:57,194 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 136 [2018-11-23 09:55:57,195 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 09:55:57,195 INFO L225 Difference]: With dead ends: 1100 [2018-11-23 09:55:57,195 INFO L226 Difference]: Without dead ends: 0 [2018-11-23 09:55:57,196 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 139 GetRequests, 133 SyntacticMatches, 0 SemanticMatches, 6 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=20, Invalid=36, Unknown=0, NotChecked=0, Total=56 [2018-11-23 09:55:57,196 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 0 states. [2018-11-23 09:55:57,197 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 0 to 0. [2018-11-23 09:55:57,197 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 0 states. [2018-11-23 09:55:57,197 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 0 states to 0 states and 0 transitions. [2018-11-23 09:55:57,197 INFO L78 Accepts]: Start accepts. Automaton has 0 states and 0 transitions. Word has length 136 [2018-11-23 09:55:57,197 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 09:55:57,197 INFO L480 AbstractCegarLoop]: Abstraction has 0 states and 0 transitions. [2018-11-23 09:55:57,197 INFO L481 AbstractCegarLoop]: Interpolant automaton has 6 states. [2018-11-23 09:55:57,197 INFO L276 IsEmpty]: Start isEmpty. Operand 0 states and 0 transitions. [2018-11-23 09:55:57,197 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 09:55:57,200 INFO L343 DoubleDeckerVisitor]: Before removal of dead ends 0 states and 0 transitions. [2018-11-23 09:55:58,554 INFO L448 ceAbstractionStarter]: For program point ULTIMATE.initFINAL(line -1) no Hoare annotation was computed. [2018-11-23 09:55:58,554 INFO L451 ceAbstractionStarter]: At program point ULTIMATE.initENTRY(line -1) the Hoare annotation is: true [2018-11-23 09:55:58,554 INFO L448 ceAbstractionStarter]: For program point ULTIMATE.initEXIT(line -1) no Hoare annotation was computed. [2018-11-23 09:55:58,554 INFO L448 ceAbstractionStarter]: For program point L1423(lines 1423 1427) no Hoare annotation was computed. [2018-11-23 09:55:58,554 INFO L448 ceAbstractionStarter]: For program point L1390(lines 1390 1394) no Hoare annotation was computed. [2018-11-23 09:55:58,554 INFO L448 ceAbstractionStarter]: For program point L1258(lines 1258 1263) no Hoare annotation was computed. [2018-11-23 09:55:58,555 INFO L448 ceAbstractionStarter]: For program point L1490(lines 1490 1501) no Hoare annotation was computed. [2018-11-23 09:55:58,555 INFO L448 ceAbstractionStarter]: For program point L1490-1(lines 1490 1501) no Hoare annotation was computed. [2018-11-23 09:55:58,555 INFO L444 ceAbstractionStarter]: At program point L1391(lines 1099 1646) the Hoare annotation is: (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset)) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32)))) [2018-11-23 09:55:58,555 INFO L448 ceAbstractionStarter]: For program point L1226(lines 1226 1572) no Hoare annotation was computed. [2018-11-23 09:55:58,555 INFO L448 ceAbstractionStarter]: For program point L1193(lines 1193 1583) no Hoare annotation was computed. [2018-11-23 09:55:58,555 INFO L448 ceAbstractionStarter]: For program point L1160(lines 1160 1594) no Hoare annotation was computed. [2018-11-23 09:55:58,555 INFO L444 ceAbstractionStarter]: At program point L1227(lines 1226 1572) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,555 INFO L444 ceAbstractionStarter]: At program point L1194(lines 1184 1586) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,555 INFO L448 ceAbstractionStarter]: For program point L1558(lines 1558 1562) no Hoare annotation was computed. [2018-11-23 09:55:58,555 INFO L448 ceAbstractionStarter]: For program point L1525(lines 1525 1530) no Hoare annotation was computed. [2018-11-23 09:55:58,555 INFO L448 ceAbstractionStarter]: For program point L1492(lines 1492 1498) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1460(lines 1460 1464) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1460-2(lines 1460 1464) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1229(lines 1229 1571) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1196(lines 1196 1582) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1163(lines 1163 1593) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1130-1(lines 1099 1646) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1395(lines 1395 1399) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L451 ceAbstractionStarter]: At program point L1230(lines 1229 1571) the Hoare annotation is: true [2018-11-23 09:55:58,556 INFO L444 ceAbstractionStarter]: At program point L1164(lines 1160 1594) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1131(line 1131) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1429(lines 1429 1434) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1429-2(lines 1429 1434) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1330(lines 1330 1344) no Hoare annotation was computed. [2018-11-23 09:55:58,556 INFO L448 ceAbstractionStarter]: For program point L1330-2(lines 1330 1344) no Hoare annotation was computed. [2018-11-23 09:55:58,557 INFO L448 ceAbstractionStarter]: For program point L1364(lines 1364 1369) no Hoare annotation was computed. [2018-11-23 09:55:58,557 INFO L448 ceAbstractionStarter]: For program point L1199(lines 1199 1581) no Hoare annotation was computed. [2018-11-23 09:55:58,557 INFO L448 ceAbstractionStarter]: For program point L1166(lines 1166 1592) no Hoare annotation was computed. [2018-11-23 09:55:58,557 INFO L448 ceAbstractionStarter]: For program point L1133(lines 1133 1603) no Hoare annotation was computed. [2018-11-23 09:55:58,557 INFO L451 ceAbstractionStarter]: At program point L1233(lines 1232 1570) the Hoare annotation is: true [2018-11-23 09:55:58,557 INFO L444 ceAbstractionStarter]: At program point L1200(lines 1196 1582) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,557 INFO L444 ceAbstractionStarter]: At program point L1134(lines 1133 1603) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,557 INFO L448 ceAbstractionStarter]: For program point L1466(lines 1466 1471) no Hoare annotation was computed. [2018-11-23 09:55:58,557 INFO L448 ceAbstractionStarter]: For program point L1400(lines 1400 1404) no Hoare annotation was computed. [2018-11-23 09:55:58,557 INFO L448 ceAbstractionStarter]: For program point L1334(lines 1334 1338) no Hoare annotation was computed. [2018-11-23 09:55:58,557 INFO L448 ceAbstractionStarter]: For program point L1400-2(lines 1400 1404) no Hoare annotation was computed. [2018-11-23 09:55:58,557 INFO L448 ceAbstractionStarter]: For program point L1334-2(lines 1332 1344) no Hoare annotation was computed. [2018-11-23 09:55:58,558 INFO L448 ceAbstractionStarter]: For program point L1202(lines 1202 1580) no Hoare annotation was computed. [2018-11-23 09:55:58,558 INFO L448 ceAbstractionStarter]: For program point L1169(lines 1169 1591) no Hoare annotation was computed. [2018-11-23 09:55:58,558 INFO L448 ceAbstractionStarter]: For program point L1136(lines 1136 1602) no Hoare annotation was computed. [2018-11-23 09:55:58,558 INFO L448 ceAbstractionStarter]: For program point L1302(lines 1302 1306) no Hoare annotation was computed. [2018-11-23 09:55:58,558 INFO L448 ceAbstractionStarter]: For program point L1269(lines 1269 1274) no Hoare annotation was computed. [2018-11-23 09:55:58,558 INFO L444 ceAbstractionStarter]: At program point L1170(lines 1166 1592) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,558 INFO L444 ceAbstractionStarter]: At program point L1568(lines 1234 1569) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,558 INFO L448 ceAbstractionStarter]: For program point L1205(lines 1205 1579) no Hoare annotation was computed. [2018-11-23 09:55:58,558 INFO L448 ceAbstractionStarter]: For program point L1172(lines 1172 1590) no Hoare annotation was computed. [2018-11-23 09:55:58,558 INFO L448 ceAbstractionStarter]: For program point L1139(lines 1139 1601) no Hoare annotation was computed. [2018-11-23 09:55:58,558 INFO L451 ceAbstractionStarter]: At program point L1635(lines 1129 1636) the Hoare annotation is: true [2018-11-23 09:55:58,558 INFO L444 ceAbstractionStarter]: At program point L1239(lines 1136 1602) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,559 INFO L444 ceAbstractionStarter]: At program point L1206(lines 1202 1580) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,559 INFO L451 ceAbstractionStarter]: At program point ssl3_connectENTRY(lines 1076 1647) the Hoare annotation is: true [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1604(lines 1604 1632) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1604-1(lines 1604 1632) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1538(lines 1538 1542) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1538-2(lines 1538 1542) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1208(lines 1208 1578) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1175(lines 1175 1589) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1142(lines 1142 1600) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1605(lines 1605 1629) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1473(lines 1473 1478) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1440(lines 1440 1444) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L448 ceAbstractionStarter]: For program point L1374(lines 1374 1378) no Hoare annotation was computed. [2018-11-23 09:55:58,559 INFO L444 ceAbstractionStarter]: At program point L1176(lines 1172 1590) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1110(lines 1110 1118) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1639(lines 1639 1643) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1606(lines 1606 1615) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1639-2(lines 1639 1643) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1606-2(lines 1605 1627) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1507(lines 1507 1511) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION(line 1645) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1276(lines 1276 1281) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1244(lines 1244 1248) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1211(lines 1211 1577) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1178(lines 1178 1588) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1244-2(lines 1244 1248) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1145(lines 1145 1599) no Hoare annotation was computed. [2018-11-23 09:55:58,560 INFO L448 ceAbstractionStarter]: For program point L1608(lines 1608 1612) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point $Ultimate##85(lines 1234 1569) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point $Ultimate##84(lines 1234 1569) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point L1311(lines 1311 1315) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point L1311-2(lines 1234 1567) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L444 ceAbstractionStarter]: At program point L1212(lines 1208 1578) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point L1113(lines 1113 1117) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point L1113-2(lines 1110 1118) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point L1543(lines 1543 1547) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point L1543-2(lines 1543 1547) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point L1412(lines 1412 1416) no Hoare annotation was computed. [2018-11-23 09:55:58,561 INFO L448 ceAbstractionStarter]: For program point L1379(lines 1379 1383) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point L1214(lines 1214 1576) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point L1181(lines 1181 1587) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point L1148(lines 1148 1598) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point L1512(lines 1512 1516) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point L1512-2(lines 1512 1516) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L444 ceAbstractionStarter]: At program point L1182(lines 1178 1588) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point ssl3_connectEXIT(lines 1076 1647) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point L1249(lines 1249 1254) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point ssl3_connectFINAL(lines 1076 1647) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point L1217(lines 1217 1575) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point L1184(lines 1184 1586) no Hoare annotation was computed. [2018-11-23 09:55:58,562 INFO L448 ceAbstractionStarter]: For program point L1151(lines 1151 1597) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L444 ceAbstractionStarter]: At program point L1218(lines 1214 1576) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,563 INFO L444 ceAbstractionStarter]: At program point L1152(lines 1148 1598) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1483(lines 1483 1487) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1351(lines 1351 1355) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1351-2(lines 1234 1567) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1120(lines 1120 1128) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1550(lines 1550 1554) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1550-2(lines 1550 1554) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1220(lines 1220 1574) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1187(lines 1187 1585) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1154(lines 1154 1596) no Hoare annotation was computed. [2018-11-23 09:55:58,563 INFO L448 ceAbstractionStarter]: For program point L1121(lines 1121 1125) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1617(lines 1617 1623) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1452(lines 1452 1456) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1321(lines 1321 1325) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1321-2(lines 1321 1325) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1256(lines 1256 1267) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1223(lines 1223 1573) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1190(lines 1190 1584) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1256-2(lines 1256 1267) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1157(lines 1157 1595) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1521(lines 1521 1534) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1521-2(lines 1521 1534) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1290(lines 1290 1294) no Hoare annotation was computed. [2018-11-23 09:55:58,564 INFO L444 ceAbstractionStarter]: At program point L1224(lines 1220 1574) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,564 INFO L448 ceAbstractionStarter]: For program point L1290-2(lines 1234 1567) no Hoare annotation was computed. [2018-11-23 09:55:58,565 INFO L444 ceAbstractionStarter]: At program point L1158(lines 1154 1596) the Hoare annotation is: (let ((.cse0 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32)) .cse0) (and .cse0 (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967292 32)) (_ bv0 32)) .cse0) (and (= ssl3_connect_~blastFlag~0 (_ bv0 32)) .cse0) (not (= |ssl3_connect_#in~s.offset| (_ bv0 32))) (and (= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32)) .cse0))) [2018-11-23 09:55:58,565 INFO L448 ceAbstractionStarter]: For program point ULTIMATE.startEXIT(line -1) no Hoare annotation was computed. [2018-11-23 09:55:58,565 INFO L451 ceAbstractionStarter]: At program point L-1(line -1) the Hoare annotation is: true [2018-11-23 09:55:58,565 INFO L451 ceAbstractionStarter]: At program point ULTIMATE.startENTRY(line -1) the Hoare annotation is: true [2018-11-23 09:55:58,565 INFO L448 ceAbstractionStarter]: For program point ULTIMATE.startFINAL(line -1) no Hoare annotation was computed. [2018-11-23 09:55:58,565 INFO L444 ceAbstractionStarter]: At program point L1071(line 1071) the Hoare annotation is: (= main_~s~0.offset (_ bv0 32)) [2018-11-23 09:55:58,565 INFO L448 ceAbstractionStarter]: For program point L1071-1(line 1071) no Hoare annotation was computed. [2018-11-23 09:55:58,565 INFO L451 ceAbstractionStarter]: At program point mainENTRY(lines 1061 1075) the Hoare annotation is: true [2018-11-23 09:55:58,565 INFO L448 ceAbstractionStarter]: For program point mainFINAL(lines 1061 1075) no Hoare annotation was computed. [2018-11-23 09:55:58,565 INFO L448 ceAbstractionStarter]: For program point mainEXIT(lines 1061 1075) no Hoare annotation was computed. [2018-11-23 09:55:58,591 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 23.11 09:55:58 BoogieIcfgContainer [2018-11-23 09:55:58,591 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2018-11-23 09:55:58,591 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2018-11-23 09:55:58,591 INFO L271 PluginConnector]: Initializing Witness Printer... [2018-11-23 09:55:58,591 INFO L276 PluginConnector]: Witness Printer initialized [2018-11-23 09:55:58,592 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 09:55:04" (3/4) ... [2018-11-23 09:55:58,596 INFO L144 WitnessPrinter]: Generating witness for correct program [2018-11-23 09:55:58,602 INFO L354 RCFGBacktranslator]: Ignoring RootEdge to procedure ULTIMATE.init [2018-11-23 09:55:58,602 INFO L354 RCFGBacktranslator]: Ignoring RootEdge to procedure ssl3_connect [2018-11-23 09:55:58,602 INFO L354 RCFGBacktranslator]: Ignoring RootEdge to procedure main [2018-11-23 09:55:58,611 INFO L879 BoogieBacktranslator]: Reduced CFG by removing 20 nodes and edges [2018-11-23 09:55:58,612 INFO L879 BoogieBacktranslator]: Reduced CFG by removing 9 nodes and edges [2018-11-23 09:55:58,612 INFO L879 BoogieBacktranslator]: Reduced CFG by removing 4 nodes and edges [2018-11-23 09:55:58,614 INFO L879 BoogieBacktranslator]: Reduced CFG by removing 2 nodes and edges [2018-11-23 09:55:58,614 INFO L879 BoogieBacktranslator]: Reduced CFG by removing 1 nodes and edges [2018-11-23 09:55:58,684 INFO L145 WitnessManager]: Wrote witness to /tmp/vcloud-vcloud-master/worker/working_dir_e0361529-707d-42f4-a6d8-2ea7e8d50a6a/bin-2019/uautomizer/witness.graphml [2018-11-23 09:55:58,685 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-23 09:55:58,686 INFO L168 Benchmark]: Toolchain (without parser) took 57140.05 ms. Allocated memory was 1.0 GB in the beginning and 1.4 GB in the end (delta: 321.4 MB). Free memory was 943.8 MB in the beginning and 892.5 MB in the end (delta: 51.3 MB). Peak memory consumption was 372.7 MB. Max. memory is 11.5 GB. [2018-11-23 09:55:58,686 INFO L168 Benchmark]: CDTParser took 0.12 ms. Allocated memory is still 1.0 GB. Free memory is still 978.7 MB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-23 09:55:58,686 INFO L168 Benchmark]: CACSL2BoogieTranslator took 522.27 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 164.1 MB). Free memory was 943.8 MB in the beginning and 1.1 GB in the end (delta: -199.4 MB). Peak memory consumption was 46.9 MB. Max. memory is 11.5 GB. [2018-11-23 09:55:58,687 INFO L168 Benchmark]: Boogie Procedure Inliner took 32.60 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 6.6 MB). Peak memory consumption was 6.6 MB. Max. memory is 11.5 GB. [2018-11-23 09:55:58,687 INFO L168 Benchmark]: Boogie Preprocessor took 59.50 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 8.3 MB). Peak memory consumption was 8.3 MB. Max. memory is 11.5 GB. [2018-11-23 09:55:58,687 INFO L168 Benchmark]: RCFGBuilder took 1876.07 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 77.5 MB). Peak memory consumption was 77.5 MB. Max. memory is 11.5 GB. [2018-11-23 09:55:58,687 INFO L168 Benchmark]: TraceAbstraction took 54552.25 ms. Allocated memory was 1.2 GB in the beginning and 1.4 GB in the end (delta: 157.3 MB). Free memory was 1.1 GB in the beginning and 909.9 MB in the end (delta: 140.9 MB). Peak memory consumption was 298.2 MB. Max. memory is 11.5 GB. [2018-11-23 09:55:58,687 INFO L168 Benchmark]: Witness Printer took 93.80 ms. Allocated memory is still 1.4 GB. Free memory was 909.9 MB in the beginning and 892.5 MB in the end (delta: 17.3 MB). Peak memory consumption was 17.3 MB. Max. memory is 11.5 GB. [2018-11-23 09:55:58,689 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.12 ms. Allocated memory is still 1.0 GB. Free memory is still 978.7 MB. There was no memory consumed. Max. memory is 11.5 GB. * CACSL2BoogieTranslator took 522.27 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 164.1 MB). Free memory was 943.8 MB in the beginning and 1.1 GB in the end (delta: -199.4 MB). Peak memory consumption was 46.9 MB. Max. memory is 11.5 GB. * Boogie Procedure Inliner took 32.60 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 6.6 MB). Peak memory consumption was 6.6 MB. Max. memory is 11.5 GB. * Boogie Preprocessor took 59.50 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 8.3 MB). Peak memory consumption was 8.3 MB. Max. memory is 11.5 GB. * RCFGBuilder took 1876.07 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 77.5 MB). Peak memory consumption was 77.5 MB. Max. memory is 11.5 GB. * TraceAbstraction took 54552.25 ms. Allocated memory was 1.2 GB in the beginning and 1.4 GB in the end (delta: 157.3 MB). Free memory was 1.1 GB in the beginning and 909.9 MB in the end (delta: 140.9 MB). Peak memory consumption was 298.2 MB. Max. memory is 11.5 GB. * Witness Printer took 93.80 ms. Allocated memory is still 1.4 GB. Free memory was 909.9 MB in the beginning and 892.5 MB in the end (delta: 17.3 MB). Peak memory consumption was 17.3 MB. Max. memory is 11.5 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - PositiveResult [Line: 1645]: call of __VERIFIER_error() unreachable For all program executions holds that call of __VERIFIER_error() unreachable at this location - AllSpecificationsHoldResult: All specifications hold 1 specifications checked. All of them hold - InvariantResult [Line: 1202]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1234]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1160]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1136]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1184]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1148]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1226]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1129]: Loop Invariant Derived loop invariant: 1 - InvariantResult [Line: 1133]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1229]: Loop Invariant Derived loop invariant: 1 - InvariantResult [Line: 1099]: Loop Invariant Derived loop invariant: (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s) || !(s == 0bv32) - InvariantResult [Line: 1214]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1172]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1154]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1232]: Loop Invariant Derived loop invariant: 1 - InvariantResult [Line: 1208]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1196]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1178]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1166]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - InvariantResult [Line: 1220]: Loop Invariant Derived loop invariant: (((((~bvadd64(blastFlag, 4294967295bv32) == 0bv32 && 0bv32 == s) || (0bv32 == s && ~bvadd64(blastFlag, 4294967293bv32) == 0bv32)) || (~bvadd64(blastFlag, 4294967292bv32) == 0bv32 && 0bv32 == s)) || (blastFlag == 0bv32 && 0bv32 == s)) || !(s == 0bv32)) || (~bvadd64(blastFlag, 4294967294bv32) == 0bv32 && 0bv32 == s) - StatisticsResult: Ultimate Automizer benchmark data CFG has 4 procedures, 142 locations, 1 error locations. SAFE Result, 54.4s OverallTime, 10 OverallIterations, 7 TraceHistogramMax, 30.9s AutomataDifference, 0.0s DeadEndRemovalTime, 1.3s HoareAnnotationTime, HoareTripleCheckerStatistics: 2215 SDtfs, 2547 SDslu, 2629 SDs, 0 SdLazy, 2121 SolverSat, 108 SolverUnsat, 0 SolverUnknown, 0 SolverNotchecked, 28.5s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 921 GetRequests, 880 SyntacticMatches, 2 SemanticMatches, 39 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.6s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=646occurred in iteration=9, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 0.1s AutomataMinimizationTime, 10 MinimizatonAttempts, 652 StatesRemovedByMinimization, 4 NontrivialMinimizations, HoareAnnotationStatistics: 0.0s HoareAnnotationTime, 26 LocationsWithAnnotation, 26 PreInvPairs, 198 NumberOfFragments, 793 HoareAnnotationTreeSize, 26 FomulaSimplifications, 28147 FormulaSimplificationTreeSizeReduction, 0.3s HoareSimplificationTime, 26 FomulaSimplificationsInter, 1083 FormulaSimplificationTreeSizeReductionInter, 1.0s HoareSimplificationTimeInter, RefinementEngineStatistics: TraceCheckStatistics: 0.2s SsaConstructionTime, 8.2s SatisfiabilityAnalysisTime, 13.0s InterpolantComputationTime, 917 NumberOfCodeBlocks, 917 NumberOfCodeBlocksAsserted, 11 NumberOfCheckSat, 907 ConstructedInterpolants, 41 QuantifiedInterpolants, 480845 SizeOfPredicates, 42 NumberOfNonLiveVariables, 3200 ConjunctsInSsa, 60 ConjunctsInUnsatCore, 10 InterpolantComputations, 10 PerfectInterpolantSequences, 937/937 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be correct! Received shutdown request...