ssl/statem/statem_clnt.c:2911: error: MEMORY_LEAK
  memory dynamically allocated by call to `EVP_MD_CTX_new()` at line 2852, column 12 is not reachable after line 2911, column 5.
Showing all 55 steps of the trace


ssl/statem/statem_clnt.c:2842:1: start of procedure tls_construct_client_verify()
2840.   }
2841.   
2842. > int tls_construct_client_verify(SSL *s, WPACKET *pkt)
2843.   {
2844.       EVP_PKEY *pkey;

ssl/statem/statem_clnt.c:2845:5: 
2843.   {
2844.       EVP_PKEY *pkey;
2845. >     const EVP_MD *md = s->s3->tmp.md[s->cert->key - s->cert->pkeys];
2846.       EVP_MD_CTX *mctx = NULL;
2847.       unsigned u = 0;

ssl/statem/statem_clnt.c:2846:5: 
2844.       EVP_PKEY *pkey;
2845.       const EVP_MD *md = s->s3->tmp.md[s->cert->key - s->cert->pkeys];
2846. >     EVP_MD_CTX *mctx = NULL;
2847.       unsigned u = 0;
2848.       long hdatalen = 0;

ssl/statem/statem_clnt.c:2847:5: 
2845.       const EVP_MD *md = s->s3->tmp.md[s->cert->key - s->cert->pkeys];
2846.       EVP_MD_CTX *mctx = NULL;
2847. >     unsigned u = 0;
2848.       long hdatalen = 0;
2849.       void *hdata;

ssl/statem/statem_clnt.c:2848:5: 
2846.       EVP_MD_CTX *mctx = NULL;
2847.       unsigned u = 0;
2848. >     long hdatalen = 0;
2849.       void *hdata;
2850.       unsigned char *sig = NULL;

ssl/statem/statem_clnt.c:2850:5: 
2848.       long hdatalen = 0;
2849.       void *hdata;
2850. >     unsigned char *sig = NULL;
2851.   
2852.       mctx = EVP_MD_CTX_new();

ssl/statem/statem_clnt.c:2852:5: 
2850.       unsigned char *sig = NULL;
2851.   
2852. >     mctx = EVP_MD_CTX_new();
2853.       if (mctx == NULL) {
2854.           SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_MALLOC_FAILURE);

crypto/evp/digest.c:44:1: start of procedure EVP_MD_CTX_new()
  42.   }
  43.   
  44. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  45.   {
  46.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:46:5: 
  44.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  45.   {
  46. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  47.   }
  48.   

crypto/mem.c:98:1: start of procedure CRYPTO_zalloc()
    96.   }
    97.   
    98. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    99.   {
    100.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:100:5: 
    98.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    99.   {
    100. >     void *ret = CRYPTO_malloc(num, file, line);
    101.   
    102.       if (ret != NULL)

crypto/mem.c:71:1: start of procedure CRYPTO_malloc()
      69.   }
      70.   
      71. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      72.   {
      73.       void *ret = NULL;

crypto/mem.c:73:5: 
      71.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      72.   {
      73. >     void *ret = NULL;
      74.   
      75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:75:9: Taking false branch
      73.       void *ret = NULL;
      74.   
      75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                    ^
      76.           return malloc_impl(num, file, line);
      77.   

crypto/mem.c:78:9: Taking false branch
      76.           return malloc_impl(num, file, line);
      77.   
      78.       if (num <= 0)
                    ^
      79.           return NULL;
      80.   

crypto/mem.c:81:5: 
      79.           return NULL;
      80.   
      81. >     allow_customize = 0;
      82.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      83.       if (call_malloc_debug) {

crypto/mem.c:91:5: 
      89.       }
      90.   #else
      91. >     osslargused(file); osslargused(line);
      92.       ret = malloc(num);
      93.   #endif

crypto/mem.c:91:24: 
      89.       }
      90.   #else
      91. >     osslargused(file); osslargused(line);
      92.       ret = malloc(num);
      93.   #endif

crypto/mem.c:92:5: 
      90.   #else
      91.       osslargused(file); osslargused(line);
      92. >     ret = malloc(num);
      93.   #endif
      94.   

crypto/mem.c:95:5: 
      93.   #endif
      94.   
      95. >     return ret;
      96.   }
      97.   

crypto/mem.c:96:1: return from a call to CRYPTO_malloc
      94.   
      95.       return ret;
      96. > }
      97.   
      98.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:102:9: Taking true branch
    100.       void *ret = CRYPTO_malloc(num, file, line);
    101.   
    102.       if (ret != NULL)
                   ^
    103.           memset(ret, 0, num);
    104.       return ret;

crypto/mem.c:103:9: 
    101.   
    102.       if (ret != NULL)
    103. >         memset(ret, 0, num);
    104.       return ret;
    105.   }

crypto/mem.c:104:5: 
    102.       if (ret != NULL)
    103.           memset(ret, 0, num);
    104. >     return ret;
    105.   }
    106.   

crypto/mem.c:105:1: return from a call to CRYPTO_zalloc
    103.           memset(ret, 0, num);
    104.       return ret;
    105. > }
    106.   
    107.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/digest.c:47:1: return from a call to EVP_MD_CTX_new
  45.   {
  46.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  47. > }
  48.   
  49.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/statem/statem_clnt.c:2853:9: Taking false branch
2851.   
2852.       mctx = EVP_MD_CTX_new();
2853.       if (mctx == NULL) {
                ^
2854.           SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_MALLOC_FAILURE);
2855.           goto err;

ssl/statem/statem_clnt.c:2857:5: 
2855.           goto err;
2856.       }
2857. >     pkey = s->cert->key->privatekey;
2858.   
2859.       hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);

ssl/statem/statem_clnt.c:2859:5: 
2857.       pkey = s->cert->key->privatekey;
2858.   
2859. >     hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
2860.       if (hdatalen <= 0) {
2861.           SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);

crypto/bio/bio_lib.c:509:1: start of procedure BIO_ctrl()
  507.   }
  508.   
  509. > long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
  510.   {
  511.       long ret;

crypto/bio/bio_lib.c:513:9: Taking false branch
  511.       long ret;
  512.   
  513.       if (b == NULL)
                 ^
  514.           return 0;
  515.   

crypto/bio/bio_lib.c:516:10: Taking false branch
  514.           return 0;
  515.   
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                  ^
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518.           return -2;

crypto/bio/bio_lib.c:516:33: Taking true branch
  514.           return 0;
  515.   
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                                         ^
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518.           return -2;

crypto/bio/bio_lib.c:517:9: Skipping ERR_put_error(): empty list of specs
  515.   
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
                 ^
  518.           return -2;
  519.       }

crypto/bio/bio_lib.c:518:9: 
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518. >         return -2;
  519.       }
  520.   

crypto/bio/bio_lib.c:534:1: return from a call to BIO_ctrl
  532.   
  533.       return ret;
  534. > }
  535.   
  536.   long BIO_callback_ctrl(BIO *b, int cmd,

ssl/statem/statem_clnt.c:2860:9: Taking true branch
2858.   
2859.       hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
2860.       if (hdatalen <= 0) {
                ^
2861.           SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
2862.           goto err;

ssl/statem/statem_clnt.c:2861:9: Skipping ERR_put_error(): empty list of specs
2859.       hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
2860.       if (hdatalen <= 0) {
2861.           SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
                ^
2862.           goto err;
2863.       }

ssl/statem/statem_clnt.c:2909:2: 
2907.       EVP_MD_CTX_free(mctx);
2908.       return 1;
2909. >  err:
2910.       OPENSSL_free(sig);
2911.       EVP_MD_CTX_free(mctx);

ssl/statem/statem_clnt.c:2910:5: 
2908.       return 1;
2909.    err:
2910. >     OPENSSL_free(sig);
2911.       EVP_MD_CTX_free(mctx);
2912.       ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);

crypto/mem.c:163:1: start of procedure CRYPTO_free()
  161.   }
  162.   
  163. > void CRYPTO_free(void *str, const char *file, int line)
  164.   {
  165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:165:9: Taking false branch
  163.   void CRYPTO_free(void *str, const char *file, int line)
  164.   {
  165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                 ^
  166.           free_impl(str, file, line);
  167.           return;

crypto/mem.c:179:5: 
  177.       }
  178.   #else
  179. >     free(str);
  180.   #endif
  181.   }

crypto/mem.c:181:1: return from a call to CRYPTO_free
  179.       free(str);
  180.   #endif
  181. > }
  182.   
  183.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

ssl/statem/statem_clnt.c:2911:5: 
2909.    err:
2910.       OPENSSL_free(sig);
2911. >     EVP_MD_CTX_free(mctx);
2912.       ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
2913.       return 0;

crypto/evp/digest.c:49:1: start of procedure EVP_MD_CTX_free()
  47.   }
  48.   
  49. > void EVP_MD_CTX_free(EVP_MD_CTX *ctx)
  50.   {
  51.       EVP_MD_CTX_reset(ctx);

crypto/evp/digest.c:51:5: Skipping EVP_MD_CTX_reset(): empty list of specs
  49.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)
  50.   {
  51.       EVP_MD_CTX_reset(ctx);
            ^
  52.       OPENSSL_free(ctx);
  53.   }

crypto/evp/digest.c:52:5: 
  50.   {
  51.       EVP_MD_CTX_reset(ctx);
  52. >     OPENSSL_free(ctx);
  53.   }
  54.   

crypto/mem.c:163:1: start of procedure CRYPTO_free()
    161.   }
    162.   
    163. > void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:165:9: Taking true branch
    163.   void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                   ^
    166.           free_impl(str, file, line);
    167.           return;

crypto/mem.c:165:30: Taking true branch
    163.   void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                                        ^
    166.           free_impl(str, file, line);
    167.           return;

crypto/mem.c:166:9: Skipping __function_pointer__(): unresolved function pointer
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
    166.           free_impl(str, file, line);
                   ^
    167.           return;
    168.       }

crypto/mem.c:167:9: 
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
    166.           free_impl(str, file, line);
    167. >         return;
    168.       }
    169.   

crypto/mem.c:181:1: return from a call to CRYPTO_free
    179.       free(str);
    180.   #endif
    181. > }
    182.   
    183.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

crypto/evp/digest.c:53:1: return from a call to EVP_MD_CTX_free
  51.       EVP_MD_CTX_reset(ctx);
  52.       OPENSSL_free(ctx);
  53. > }
  54.   
  55.   int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type)

int tls_construct_client_verify(SSL *s, WPACKET *pkt)
{
    EVP_PKEY *pkey;
    const EVP_MD *md = s->s3->tmp.md[s->cert->key - s->cert->pkeys];
    EVP_MD_CTX *mctx = NULL;
    unsigned u = 0;
    long hdatalen = 0;
    void *hdata;
    unsigned char *sig = NULL;
    mctx = EVP_MD_CTX_new();
    if (mctx == NULL) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    pkey = s->cert->key->privatekey;
    hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
    if (hdatalen <= 0) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    if (SSL_USE_SIGALGS(s)&& !tls12_get_sigandhash(pkt, pkey, md)) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
        goto err;
    }
#ifdef SSL_DEBUG
    fprintf(stderr, "Using client alg %s\n", EVP_MD_name(md));
#endif
    sig = OPENSSL_malloc(EVP_PKEY_size(pkey));
    if (sig == NULL) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if (!EVP_SignInit_ex(mctx, md, NULL)
        || !EVP_SignUpdate(mctx, hdata, hdatalen)
        || (s->version == SSL3_VERSION
            && !EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,
                                (int)s->session->master_key_length,
                                s->session->master_key))
        || !EVP_SignFinal(mctx, sig, &u, pkey)) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_EVP_LIB);
        goto err;
    }
#ifndef OPENSSL_NO_GOST
    {
        int pktype = EVP_PKEY_id(pkey);
        if (pktype == NID_id_GostR3410_2001
            || pktype == NID_id_GostR3410_2012_256
            || pktype == NID_id_GostR3410_2012_512)
            BUF_reverse(sig, NULL, u);
    }
#endif
    if (!WPACKET_sub_memcpy_u16(pkt, sig, u)) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    if (!ssl3_digest_cached_records(s, 0))
        goto err;
    OPENSSL_free(sig);
    EVP_MD_CTX_free(mctx);
    return 1;
 err:
    OPENSSL_free(sig);
    EVP_MD_CTX_free(mctx);
    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
    return 0;
}
['int tls_construct_client_verify(SSL *s, WPACKET *pkt)\n{\n    EVP_PKEY *pkey;\n    const EVP_MD *md = s->s3->tmp.md[s->cert->key - s->cert->pkeys];\n    EVP_MD_CTX *mctx = NULL;\n    unsigned u = 0;\n    long hdatalen = 0;\n    void *hdata;\n    unsigned char *sig = NULL;\n    mctx = EVP_MD_CTX_new();\n    if (mctx == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    pkey = s->cert->key->privatekey;\n    hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);\n    if (hdatalen <= 0) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (SSL_USE_SIGALGS(s)&& !tls12_get_sigandhash(pkt, pkey, md)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n#ifdef SSL_DEBUG\n    fprintf(stderr, "Using client alg %s\\n", EVP_MD_name(md));\n#endif\n    sig = OPENSSL_malloc(EVP_PKEY_size(pkey));\n    if (sig == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (!EVP_SignInit_ex(mctx, md, NULL)\n        || !EVP_SignUpdate(mctx, hdata, hdatalen)\n        || (s->version == SSL3_VERSION\n            && !EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,\n                                (int)s->session->master_key_length,\n                                s->session->master_key))\n        || !EVP_SignFinal(mctx, sig, &u, pkey)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_EVP_LIB);\n        goto err;\n    }\n#ifndef OPENSSL_NO_GOST\n    {\n        int pktype = EVP_PKEY_id(pkey);\n        if (pktype == NID_id_GostR3410_2001\n            || pktype == NID_id_GostR3410_2012_256\n            || pktype == NID_id_GostR3410_2012_512)\n            BUF_reverse(sig, NULL, u);\n    }\n#endif\n    if (!WPACKET_sub_memcpy_u16(pkt, sig, u)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (!ssl3_digest_cached_records(s, 0))\n        goto err;\n    OPENSSL_free(sig);\n    EVP_MD_CTX_free(mctx);\n    return 1;\n err:\n    OPENSSL_free(sig);\n    EVP_MD_CTX_free(mctx);\n    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n    return 0;\n}', 'EVP_MD_CTX *EVP_MD_CTX_new(void)\n{\n    return OPENSSL_zalloc(sizeof(EVP_MD_CTX));\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}', 'long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)\n{\n    long ret;\n    if (b == NULL)\n        return 0;\n    if ((b->method == NULL) || (b->method->ctrl == NULL)) {\n        BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);\n        return -2;\n    }\n    if (b->callback != NULL || b->callback_ex != NULL) {\n        ret = bio_call_callback(b, BIO_CB_CTRL, parg, 0, cmd, larg, 1L, NULL);\n        if (ret <= 0)\n            return ret;\n    }\n    ret = b->method->ctrl(b, cmd, larg, parg);\n    if (b->callback != NULL || b->callback_ex != NULL)\n        ret = bio_call_callback(b, BIO_CB_CTRL | BIO_CB_RETURN, parg, 0, cmd,\n                                larg, ret, NULL);\n    return ret;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}', 'void EVP_MD_CTX_free(EVP_MD_CTX *ctx)\n{\n    EVP_MD_CTX_reset(ctx);\n    OPENSSL_free(ctx);\n}']