ssl/record/rec_layer_d1.c:314: error: MEMORY_LEAK
  memory dynamically allocated to `return` by call to `CRYPTO_malloc()` at line 266, column 13 is not reachable after line 314, column 5.
Showing all 54 steps of the trace


ssl/record/rec_layer_d1.c:257:1: start of procedure dtls1_buffer_record()
255.   }
256.   
257. > int dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
258.   {
259.       DTLS1_RECORD_DATA *rdata;

ssl/record/rec_layer_d1.c:263:9: 
261.   
262.       /* Limit the size of the queue to prevent DOS attacks */
263. >     if (pqueue_size(queue->q) >= 100)
264.           return 0;
265.   

ssl/pqueue.c:208:1: start of procedure pqueue_size()
  206.   }
  207.   
  208. > int pqueue_size(pqueue *pq)
  209.   {
  210.       pitem *item = pq->items;

ssl/pqueue.c:210:5: 
  208.   int pqueue_size(pqueue *pq)
  209.   {
  210. >     pitem *item = pq->items;
  211.       int count = 0;
  212.   

ssl/pqueue.c:211:5: 
  209.   {
  210.       pitem *item = pq->items;
  211. >     int count = 0;
  212.   
  213.       while (item != NULL) {

ssl/pqueue.c:213:12: Loop condition is true. Entering loop body
  211.       int count = 0;
  212.   
  213.       while (item != NULL) {
                    ^
  214.           count++;
  215.           item = item->next;

ssl/pqueue.c:214:9: 
  212.   
  213.       while (item != NULL) {
  214. >         count++;
  215.           item = item->next;
  216.       }

ssl/pqueue.c:215:9: 
  213.       while (item != NULL) {
  214.           count++;
  215. >         item = item->next;
  216.       }
  217.       return count;

ssl/pqueue.c:213:12: Loop condition is false. Leaving loop
  211.       int count = 0;
  212.   
  213.       while (item != NULL) {
                    ^
  214.           count++;
  215.           item = item->next;

ssl/pqueue.c:217:5: 
  215.           item = item->next;
  216.       }
  217. >     return count;
  218.   }

ssl/pqueue.c:218:1: return from a call to pqueue_size
  216.       }
  217.       return count;
  218. > }

ssl/record/rec_layer_d1.c:263:9: Taking false branch
261.   
262.       /* Limit the size of the queue to prevent DOS attacks */
263.       if (pqueue_size(queue->q) >= 100)
               ^
264.           return 0;
265.   

ssl/record/rec_layer_d1.c:266:5: 
264.           return 0;
265.   
266. >     rdata = OPENSSL_malloc(sizeof(*rdata));
267.       item = pitem_new(priority, rdata);
268.       if (rdata == NULL || item == NULL) {

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
  118.   }
  119.   
  120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
  121.   {
  122.       void *ret = NULL;

crypto/mem.c:122:5: 
  120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
  121.   {
  122. >     void *ret = NULL;
  123.   
  124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
  122.       void *ret = NULL;
  123.   
  124.       if (num <= 0)
                 ^
  125.           return NULL;
  126.   

crypto/mem.c:127:5: 
  125.           return NULL;
  126.   
  127. >     allow_customize = 0;
  128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
  129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
  135.       }
  136.   #else
  137. >     (void)file;
  138.       (void)line;
  139.       ret = malloc(num);

crypto/mem.c:138:5: 
  136.   #else
  137.       (void)file;
  138. >     (void)line;
  139.       ret = malloc(num);
  140.   #endif

crypto/mem.c:139:5: 
  137.       (void)file;
  138.       (void)line;
  139. >     ret = malloc(num);
  140.   #endif
  141.   

crypto/mem.c:154:5: 
  152.   #endif
  153.   
  154. >     return ret;
  155.   }
  156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
  153.   
  154.       return ret;
  155. > }
  156.   
  157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/record/rec_layer_d1.c:267:5: 
265.   
266.       rdata = OPENSSL_malloc(sizeof(*rdata));
267. >     item = pitem_new(priority, rdata);
268.       if (rdata == NULL || item == NULL) {
269.           OPENSSL_free(rdata);

ssl/pqueue.c:68:1: start of procedure pitem_new()
  66.   };
  67.   
  68. > pitem *pitem_new(unsigned char *prio64be, void *data)
  69.   {
  70.       pitem *item = OPENSSL_malloc(sizeof(*item));

ssl/pqueue.c:70:5: 
  68.   pitem *pitem_new(unsigned char *prio64be, void *data)
  69.   {
  70. >     pitem *item = OPENSSL_malloc(sizeof(*item));
  71.       if (item == NULL)
  72.           return NULL;

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/pqueue.c:71:9: Taking false branch
  69.   {
  70.       pitem *item = OPENSSL_malloc(sizeof(*item));
  71.       if (item == NULL)
                ^
  72.           return NULL;
  73.   

ssl/pqueue.c:74:5: 
  72.           return NULL;
  73.   
  74. >     memcpy(item->priority, prio64be, sizeof(item->priority));
  75.   
  76.       item->data = data;

ssl/pqueue.c:76:5: 
  74.       memcpy(item->priority, prio64be, sizeof(item->priority));
  75.   
  76. >     item->data = data;
  77.       item->next = NULL;
  78.   

ssl/pqueue.c:77:5: 
  75.   
  76.       item->data = data;
  77. >     item->next = NULL;
  78.   
  79.       return item;

ssl/pqueue.c:79:5: 
  77.       item->next = NULL;
  78.   
  79. >     return item;
  80.   }
  81.   

ssl/pqueue.c:80:1: return from a call to pitem_new
  78.   
  79.       return item;
  80. > }
  81.   
  82.   void pitem_free(pitem *item)

ssl/record/rec_layer_d1.c:268:9: Taking false branch
266.       rdata = OPENSSL_malloc(sizeof(*rdata));
267.       item = pitem_new(priority, rdata);
268.       if (rdata == NULL || item == NULL) {
               ^
269.           OPENSSL_free(rdata);
270.           pitem_free(item);

ssl/record/rec_layer_d1.c:268:26: Taking false branch
266.       rdata = OPENSSL_malloc(sizeof(*rdata));
267.       item = pitem_new(priority, rdata);
268.       if (rdata == NULL || item == NULL) {
                                ^
269.           OPENSSL_free(rdata);
270.           pitem_free(item);

ssl/record/rec_layer_d1.c:275:5: 
273.       }
274.   
275. >     rdata->packet = s->rlayer.packet;
276.       rdata->packet_length = s->rlayer.packet_length;
277.       memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));

ssl/record/rec_layer_d1.c:276:5: 
274.   
275.       rdata->packet = s->rlayer.packet;
276. >     rdata->packet_length = s->rlayer.packet_length;
277.       memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
278.       memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));

ssl/record/rec_layer_d1.c:277:5: 
275.       rdata->packet = s->rlayer.packet;
276.       rdata->packet_length = s->rlayer.packet_length;
277. >     memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
278.       memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
279.   

ssl/record/rec_layer_d1.c:278:5: 
276.       rdata->packet_length = s->rlayer.packet_length;
277.       memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
278. >     memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
279.   
280.       item->data = rdata;

ssl/record/rec_layer_d1.c:280:5: 
278.       memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
279.   
280. >     item->data = rdata;
281.   
282.   #ifndef OPENSSL_NO_SCTP

ssl/record/rec_layer_d1.c:292:5: 
290.   #endif
291.   
292. >     s->rlayer.packet = NULL;
293.       s->rlayer.packet_length = 0;
294.       memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));

ssl/record/rec_layer_d1.c:293:5: 
291.   
292.       s->rlayer.packet = NULL;
293. >     s->rlayer.packet_length = 0;
294.       memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
295.       memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));

ssl/record/rec_layer_d1.c:294:5: 
292.       s->rlayer.packet = NULL;
293.       s->rlayer.packet_length = 0;
294. >     memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
295.       memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
296.   

ssl/record/rec_layer_d1.c:295:5: 
293.       s->rlayer.packet_length = 0;
294.       memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
295. >     memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
296.   
297.       if (!ssl3_setup_buffers(s)) {

ssl/record/rec_layer_d1.c:297:10: Taking false branch
295.       memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
296.   
297.       if (!ssl3_setup_buffers(s)) {
                ^
298.           SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
299.           OPENSSL_free(rdata->rbuf.buf);

ssl/record/rec_layer_d1.c:306:9: Taking false branch
304.   
305.       /* insert should not fail, since duplicates are dropped */
306.       if (pqueue_insert(queue->q, item) == NULL) {
               ^
307.           SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
308.           OPENSSL_free(rdata->rbuf.buf);

ssl/record/rec_layer_d1.c:314:5: 
312.       }
313.   
314. >     return (1);
315.   }
316.   

int dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
{
    DTLS1_RECORD_DATA *rdata;
    pitem *item;
    if (pqueue_size(queue->q) >= 100)
        return 0;
    rdata = OPENSSL_malloc(sizeof(*rdata));
    item = pitem_new(priority, rdata);
    if (rdata == NULL || item == NULL) {
        OPENSSL_free(rdata);
        pitem_free(item);
        SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
        return -1;
    }
    rdata->packet = s->rlayer.packet;
    rdata->packet_length = s->rlayer.packet_length;
    memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
    memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
    item->data = rdata;
#ifndef OPENSSL_NO_SCTP
    if (BIO_dgram_is_sctp(SSL_get_rbio(s)) &&
        (SSL_get_state(s) == TLS_ST_SR_FINISHED
         || SSL_get_state(s) == TLS_ST_CR_FINISHED)) {
        BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SCTP_GET_RCVINFO,
                 sizeof(rdata->recordinfo), &rdata->recordinfo);
    }
#endif
    s->rlayer.packet = NULL;
    s->rlayer.packet_length = 0;
    memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
    memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
    if (!ssl3_setup_buffers(s)) {
        SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
        OPENSSL_free(rdata->rbuf.buf);
        OPENSSL_free(rdata);
        pitem_free(item);
        return (-1);
    }
    if (pqueue_insert(queue->q, item) == NULL) {
        SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
        OPENSSL_free(rdata->rbuf.buf);
        OPENSSL_free(rdata);
        pitem_free(item);
        return (-1);
    }
    return (1);
}
['int dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)\n{\n    DTLS1_RECORD_DATA *rdata;\n    pitem *item;\n    if (pqueue_size(queue->q) >= 100)\n        return 0;\n    rdata = OPENSSL_malloc(sizeof(*rdata));\n    item = pitem_new(priority, rdata);\n    if (rdata == NULL || item == NULL) {\n        OPENSSL_free(rdata);\n        pitem_free(item);\n        SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);\n        return -1;\n    }\n    rdata->packet = s->rlayer.packet;\n    rdata->packet_length = s->rlayer.packet_length;\n    memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));\n    memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));\n    item->data = rdata;\n#ifndef OPENSSL_NO_SCTP\n    if (BIO_dgram_is_sctp(SSL_get_rbio(s)) &&\n        (SSL_get_state(s) == TLS_ST_SR_FINISHED\n         || SSL_get_state(s) == TLS_ST_CR_FINISHED)) {\n        BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SCTP_GET_RCVINFO,\n                 sizeof(rdata->recordinfo), &rdata->recordinfo);\n    }\n#endif\n    s->rlayer.packet = NULL;\n    s->rlayer.packet_length = 0;\n    memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));\n    memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));\n    if (!ssl3_setup_buffers(s)) {\n        SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);\n        OPENSSL_free(rdata->rbuf.buf);\n        OPENSSL_free(rdata);\n        pitem_free(item);\n        return (-1);\n    }\n    if (pqueue_insert(queue->q, item) == NULL) {\n        SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);\n        OPENSSL_free(rdata->rbuf.buf);\n        OPENSSL_free(rdata);\n        pitem_free(item);\n        return (-1);\n    }\n    return (1);\n}', 'int pqueue_size(pqueue *pq)\n{\n    pitem *item = pq->items;\n    int count = 0;\n    while (item != NULL) {\n        count++;\n        item = item->next;\n    }\n    return count;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'pitem *pitem_new(unsigned char *prio64be, void *data)\n{\n    pitem *item = OPENSSL_malloc(sizeof(*item));\n    if (item == NULL)\n        return NULL;\n    memcpy(item->priority, prio64be, sizeof(item->priority));\n    item->data = data;\n    item->next = NULL;\n    return item;\n}']