ssl/statem/extensions_srvr.c:760: error: MEMORY_LEAK
  memory dynamically allocated by call to `EVP_MD_CTX_new()` at line 754, column 12 is not reachable after line 760, column 9.
Showing all 79 steps of the trace


ssl/statem/extensions_srvr.c:717:1: start of procedure tls_parse_ctos_cookie()
715.   }
716.   
717. > int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
718.                             size_t chainidx)
719.   {

ssl/statem/extensions_srvr.c:732:9: Taking false branch
730.   
731.       /* Ignore any cookie if we're not set up to verify it */
732.       if (s->ctx->verify_stateless_cookie_cb == NULL
               ^
733.               || (s->s3->flags & TLS1_FLAGS_STATELESS) == 0)
734.           return 1;

ssl/statem/extensions_srvr.c:733:16: Taking false branch
731.       /* Ignore any cookie if we're not set up to verify it */
732.       if (s->ctx->verify_stateless_cookie_cb == NULL
733.               || (s->s3->flags & TLS1_FLAGS_STATELESS) == 0)
                      ^
734.           return 1;
735.   

ssl/statem/extensions_srvr.c:736:10: Taking false branch
734.           return 1;
735.   
736.       if (!PACKET_as_length_prefixed_2(pkt, &cookie)) {
                ^
737.           SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
738.                    SSL_R_LENGTH_MISMATCH);

ssl/statem/extensions_srvr.c:742:5: 
740.       }
741.   
742. >     raw = cookie;
743.       data = PACKET_data(&raw);
744.       rawlen = PACKET_remaining(&raw);

ssl/statem/extensions_srvr.c:743:5: 
741.   
742.       raw = cookie;
743. >     data = PACKET_data(&raw);
744.       rawlen = PACKET_remaining(&raw);
745.       if (rawlen < SHA256_DIGEST_LENGTH

ssl/packet_locl.h:62:1: start of procedure PACKET_data()
  60.    * For use in non-PACKETized APIs.
  61.    */
  62. > static ossl_inline const unsigned char *PACKET_data(const PACKET *pkt)
  63.   {
  64.       return pkt->curr;

ssl/packet_locl.h:64:5: 
  62.   static ossl_inline const unsigned char *PACKET_data(const PACKET *pkt)
  63.   {
  64. >     return pkt->curr;
  65.   }
  66.   

ssl/packet_locl.h:65:1: return from a call to PACKET_data
  63.   {
  64.       return pkt->curr;
  65. > }
  66.   
  67.   /*

ssl/statem/extensions_srvr.c:744:5: 
742.       raw = cookie;
743.       data = PACKET_data(&raw);
744. >     rawlen = PACKET_remaining(&raw);
745.       if (rawlen < SHA256_DIGEST_LENGTH
746.               || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {

ssl/packet_locl.h:42:1: start of procedure PACKET_remaining()
  40.    * Returns the number of bytes remaining to be read in the PACKET
  41.    */
  42. > static ossl_inline size_t PACKET_remaining(const PACKET *pkt)
  43.   {
  44.       return pkt->remaining;

ssl/packet_locl.h:44:5: 
  42.   static ossl_inline size_t PACKET_remaining(const PACKET *pkt)
  43.   {
  44. >     return pkt->remaining;
  45.   }
  46.   

ssl/packet_locl.h:45:1: return from a call to PACKET_remaining
  43.   {
  44.       return pkt->remaining;
  45. > }
  46.   
  47.   /*

ssl/statem/extensions_srvr.c:745:9: Taking false branch
743.       data = PACKET_data(&raw);
744.       rawlen = PACKET_remaining(&raw);
745.       if (rawlen < SHA256_DIGEST_LENGTH
               ^
746.               || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {
747.           SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,

ssl/statem/extensions_srvr.c:746:17: 
744.       rawlen = PACKET_remaining(&raw);
745.       if (rawlen < SHA256_DIGEST_LENGTH
746. >             || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {
747.           SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
748.                    SSL_R_LENGTH_MISMATCH);

ssl/packet_locl.h:467:8: start of procedure PACKET_forward()
  465.   
  466.   /* Move the current reading position forward |len| bytes */
  467.   __owur static ossl_inline int PACKET_forward(PACKET *pkt, size_t len)
                ^
  468.   {
  469.       if (PACKET_remaining(pkt) < len)

ssl/packet_locl.h:469:9: 
  467.   __owur static ossl_inline int PACKET_forward(PACKET *pkt, size_t len)
  468.   {
  469. >     if (PACKET_remaining(pkt) < len)
  470.           return 0;
  471.   

ssl/packet_locl.h:42:1: start of procedure PACKET_remaining()
    40.    * Returns the number of bytes remaining to be read in the PACKET
    41.    */
    42. > static ossl_inline size_t PACKET_remaining(const PACKET *pkt)
    43.   {
    44.       return pkt->remaining;

ssl/packet_locl.h:44:5: 
    42.   static ossl_inline size_t PACKET_remaining(const PACKET *pkt)
    43.   {
    44. >     return pkt->remaining;
    45.   }
    46.   

ssl/packet_locl.h:45:1: return from a call to PACKET_remaining
    43.   {
    44.       return pkt->remaining;
    45. > }
    46.   
    47.   /*

ssl/packet_locl.h:469:9: Taking false branch
  467.   __owur static ossl_inline int PACKET_forward(PACKET *pkt, size_t len)
  468.   {
  469.       if (PACKET_remaining(pkt) < len)
                 ^
  470.           return 0;
  471.   

ssl/packet_locl.h:472:5: 
  470.           return 0;
  471.   
  472. >     packet_forward(pkt, len);
  473.   
  474.       return 1;

ssl/packet_locl.h:33:1: start of procedure packet_forward()
    31.   
    32.   /* Internal unchecked shorthand; don't use outside this file. */
    33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    34.   {
    35.       pkt->curr += len;

ssl/packet_locl.h:35:5: 
    33.   static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    34.   {
    35. >     pkt->curr += len;
    36.       pkt->remaining -= len;
    37.   }

ssl/packet_locl.h:36:5: 
    34.   {
    35.       pkt->curr += len;
    36. >     pkt->remaining -= len;
    37.   }
    38.   

ssl/packet_locl.h:37:1: return from a call to packet_forward
    35.       pkt->curr += len;
    36.       pkt->remaining -= len;
    37. > }
    38.   
    39.   /*

ssl/packet_locl.h:474:5: 
  472.       packet_forward(pkt, len);
  473.   
  474. >     return 1;
  475.   }
  476.   

ssl/packet_locl.h:475:1: return from a call to PACKET_forward
  473.   
  474.       return 1;
  475. > }
  476.   
  477.   /*

ssl/statem/extensions_srvr.c:746:17: Taking false branch
744.       rawlen = PACKET_remaining(&raw);
745.       if (rawlen < SHA256_DIGEST_LENGTH
746.               || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {
                       ^
747.           SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
748.                    SSL_R_LENGTH_MISMATCH);

ssl/statem/extensions_srvr.c:751:5: 
749.           return 0;
750.       }
751. >     mdin = PACKET_data(&raw);
752.   
753.       /* Verify the HMAC of the cookie */

ssl/packet_locl.h:62:1: start of procedure PACKET_data()
  60.    * For use in non-PACKETized APIs.
  61.    */
  62. > static ossl_inline const unsigned char *PACKET_data(const PACKET *pkt)
  63.   {
  64.       return pkt->curr;

ssl/packet_locl.h:64:5: 
  62.   static ossl_inline const unsigned char *PACKET_data(const PACKET *pkt)
  63.   {
  64. >     return pkt->curr;
  65.   }
  66.   

ssl/packet_locl.h:65:1: return from a call to PACKET_data
  63.   {
  64.       return pkt->curr;
  65. > }
  66.   
  67.   /*

ssl/statem/extensions_srvr.c:754:5: 
752.   
753.       /* Verify the HMAC of the cookie */
754. >     hctx = EVP_MD_CTX_create();
755.       pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
756.                                           s->session_ctx->ext.cookie_hmac_key,

crypto/evp/digest.c:44:1: start of procedure EVP_MD_CTX_new()
  42.   }
  43.   
  44. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  45.   {
  46.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:46:5: 
  44.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  45.   {
  46. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  47.   }
  48.   

crypto/mem.c:228:1: start of procedure CRYPTO_zalloc()
    226.   }
    227.   
    228. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    229.   {
    230.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:230:5: 
    228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    229.   {
    230. >     void *ret = CRYPTO_malloc(num, file, line);
    231.   
    232.       FAILTEST();

crypto/mem.c:192:1: start of procedure CRYPTO_malloc()
      190.   #endif
      191.   
      192. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      193.   {
      194.       void *ret = NULL;

crypto/mem.c:194:5: 
      192.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      193.   {
      194. >     void *ret = NULL;
      195.   
      196.       INCREMENT(malloc_count);

crypto/mem.c:197:9: Taking false branch
      195.   
      196.       INCREMENT(malloc_count);
      197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                     ^
      198.           return malloc_impl(num, file, line);
      199.   

crypto/mem.c:200:9: Taking false branch
      198.           return malloc_impl(num, file, line);
      199.   
      200.       if (num == 0)
                     ^
      201.           return NULL;
      202.   

crypto/mem.c:204:9: Taking true branch
      202.   
      203.       FAILTEST();
      204.       if (allow_customize) {
                     ^
      205.           /*
      206.            * Disallow customization after the first allocation. We only set this

crypto/mem.c:210:9: 
      208.            * allocation.
      209.            */
      210. >         allow_customize = 0;
      211.       }
      212.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:221:5: 
      219.       }
      220.   #else
      221. >     (void)(file); (void)(line);
      222.       ret = malloc(num);
      223.   #endif

crypto/mem.c:221:19: 
      219.       }
      220.   #else
      221. >     (void)(file); (void)(line);
      222.       ret = malloc(num);
      223.   #endif

crypto/mem.c:222:5: 
      220.   #else
      221.       (void)(file); (void)(line);
      222. >     ret = malloc(num);
      223.   #endif
      224.   

crypto/mem.c:225:5: 
      223.   #endif
      224.   
      225. >     return ret;
      226.   }
      227.   

crypto/mem.c:226:1: return from a call to CRYPTO_malloc
      224.   
      225.       return ret;
      226. > }
      227.   
      228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:233:9: Taking true branch
    231.   
    232.       FAILTEST();
    233.       if (ret != NULL)
                   ^
    234.           memset(ret, 0, num);
    235.       return ret;

crypto/mem.c:234:9: 
    232.       FAILTEST();
    233.       if (ret != NULL)
    234. >         memset(ret, 0, num);
    235.       return ret;
    236.   }

crypto/mem.c:235:5: 
    233.       if (ret != NULL)
    234.           memset(ret, 0, num);
    235. >     return ret;
    236.   }
    237.   

crypto/mem.c:236:1: return from a call to CRYPTO_zalloc
    234.           memset(ret, 0, num);
    235.       return ret;
    236. > }
    237.   
    238.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/digest.c:47:1: return from a call to EVP_MD_CTX_new
  45.   {
  46.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  47. > }
  48.   
  49.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/statem/extensions_srvr.c:755:5: 
753.       /* Verify the HMAC of the cookie */
754.       hctx = EVP_MD_CTX_create();
755. >     pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
756.                                           s->session_ctx->ext.cookie_hmac_key,
757.                                           sizeof(s->session_ctx->ext

crypto/evp/p_lib.c:223:1: start of procedure EVP_PKEY_new_raw_private_key()
  221.   }
  222.   
  223. > EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
  224.                                          const unsigned char *priv,
  225.                                          size_t len)

crypto/evp/p_lib.c:227:5: Skipping EVP_PKEY_new(): empty list of specs
  225.                                          size_t len)
  226.   {
  227.       EVP_PKEY *ret = EVP_PKEY_new();
             ^
  228.   
  229.       if (ret == NULL

crypto/evp/p_lib.c:229:9: Taking true branch
  227.       EVP_PKEY *ret = EVP_PKEY_new();
  228.   
  229.       if (ret == NULL
                 ^
  230.               || !pkey_set_type(ret, e, type, NULL, -1)) {
  231.           /* EVPerr already called */

crypto/evp/p_lib.c:248:2: 
  246.       return ret;
  247.   
  248. >  err:
  249.       EVP_PKEY_free(ret);
  250.       return NULL;

crypto/evp/p_lib.c:249:5: 
  247.   
  248.    err:
  249. >     EVP_PKEY_free(ret);
  250.       return NULL;
  251.   }

crypto/evp/p_lib.c:529:1: start of procedure EVP_PKEY_free()
    527.   }
    528.   
    529. > void EVP_PKEY_free(EVP_PKEY *x)
    530.   {
    531.       int i;

crypto/evp/p_lib.c:533:9: Taking true branch
    531.       int i;
    532.   
    533.       if (x == NULL)
                   ^
    534.           return;
    535.   

crypto/evp/p_lib.c:534:9: 
    532.   
    533.       if (x == NULL)
    534. >         return;
    535.   
    536.       CRYPTO_DOWN_REF(&x->references, &i, x->lock);

crypto/evp/p_lib.c:545:1: return from a call to EVP_PKEY_free
    543.       sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
    544.       OPENSSL_free(x);
    545. > }
    546.   
    547.   static void EVP_PKEY_free_it(EVP_PKEY *x)

crypto/evp/p_lib.c:250:5: 
  248.    err:
  249.       EVP_PKEY_free(ret);
  250. >     return NULL;
  251.   }
  252.   

crypto/evp/p_lib.c:251:1: return from a call to EVP_PKEY_new_raw_private_key
  249.       EVP_PKEY_free(ret);
  250.       return NULL;
  251. > }
  252.   
  253.   EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,

ssl/statem/extensions_srvr.c:759:9: Taking false branch
757.                                           sizeof(s->session_ctx->ext
758.                                                  .cookie_hmac_key));
759.       if (hctx == NULL || pkey == NULL) {
               ^
760.           EVP_MD_CTX_free(hctx);
761.           EVP_PKEY_free(pkey);

ssl/statem/extensions_srvr.c:759:25: Taking true branch
757.                                           sizeof(s->session_ctx->ext
758.                                                  .cookie_hmac_key));
759.       if (hctx == NULL || pkey == NULL) {
                               ^
760.           EVP_MD_CTX_free(hctx);
761.           EVP_PKEY_free(pkey);

ssl/statem/extensions_srvr.c:760:9: 
758.                                                  .cookie_hmac_key));
759.       if (hctx == NULL || pkey == NULL) {
760. >         EVP_MD_CTX_free(hctx);
761.           EVP_PKEY_free(pkey);
762.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,

crypto/evp/digest.c:49:1: start of procedure EVP_MD_CTX_free()
  47.   }
  48.   
  49. > void EVP_MD_CTX_free(EVP_MD_CTX *ctx)
  50.   {
  51.       EVP_MD_CTX_reset(ctx);

crypto/evp/digest.c:51:5: Skipping EVP_MD_CTX_reset(): empty list of specs
  49.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)
  50.   {
  51.       EVP_MD_CTX_reset(ctx);
            ^
  52.       OPENSSL_free(ctx);
  53.   }

crypto/evp/digest.c:52:5: 
  50.   {
  51.       EVP_MD_CTX_reset(ctx);
  52. >     OPENSSL_free(ctx);
  53.   }
  54.   

crypto/mem.c:295:1: start of procedure CRYPTO_free()
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:298:9: Taking true branch
    296.   {
    297.       INCREMENT(free_count);
    298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                   ^
    299.           free_impl(str, file, line);
    300.           return;

crypto/mem.c:298:30: Taking true branch
    296.   {
    297.       INCREMENT(free_count);
    298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                                        ^
    299.           free_impl(str, file, line);
    300.           return;

crypto/mem.c:299:9: Skipping __function_pointer__(): unresolved function pointer
    297.       INCREMENT(free_count);
    298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
    299.           free_impl(str, file, line);
                   ^
    300.           return;
    301.       }

crypto/mem.c:300:9: 
    298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
    299.           free_impl(str, file, line);
    300. >         return;
    301.       }
    302.   

crypto/mem.c:314:1: return from a call to CRYPTO_free
    312.       free(str);
    313.   #endif
    314. > }
    315.   
    316.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

crypto/evp/digest.c:53:1: return from a call to EVP_MD_CTX_free
  51.       EVP_MD_CTX_reset(ctx);
  52.       OPENSSL_free(ctx);
  53. > }
  54.   
  55.   int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type)

int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                          size_t chainidx)
{
    unsigned int format, version, key_share, group_id;
    EVP_MD_CTX *hctx;
    EVP_PKEY *pkey;
    PACKET cookie, raw, chhash, appcookie;
    WPACKET hrrpkt;
    const unsigned char *data, *mdin, *ciphdata;
    unsigned char hmac[SHA256_DIGEST_LENGTH];
    unsigned char hrr[MAX_HRR_SIZE];
    size_t rawlen, hmaclen, hrrlen, ciphlen;
    unsigned long tm, now;
    if (s->ctx->verify_stateless_cookie_cb == NULL
            || (s->s3->flags & TLS1_FLAGS_STATELESS) == 0)
        return 1;
    if (!PACKET_as_length_prefixed_2(pkt, &cookie)) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_LENGTH_MISMATCH);
        return 0;
    }
    raw = cookie;
    data = PACKET_data(&raw);
    rawlen = PACKET_remaining(&raw);
    if (rawlen < SHA256_DIGEST_LENGTH
            || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_LENGTH_MISMATCH);
        return 0;
    }
    mdin = PACKET_data(&raw);
    hctx = EVP_MD_CTX_create();
    pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
                                        s->session_ctx->ext.cookie_hmac_key,
                                        sizeof(s->session_ctx->ext
                                               .cookie_hmac_key));
    if (hctx == NULL || pkey == NULL) {
        EVP_MD_CTX_free(hctx);
        EVP_PKEY_free(pkey);
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 ERR_R_MALLOC_FAILURE);
        return 0;
    }
    hmaclen = SHA256_DIGEST_LENGTH;
    if (EVP_DigestSignInit(hctx, NULL, EVP_sha256(), NULL, pkey) <= 0
            || EVP_DigestSign(hctx, hmac, &hmaclen, data,
                              rawlen - SHA256_DIGEST_LENGTH) <= 0
            || hmaclen != SHA256_DIGEST_LENGTH) {
        EVP_MD_CTX_free(hctx);
        EVP_PKEY_free(pkey);
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 ERR_R_INTERNAL_ERROR);
        return 0;
    }
    EVP_MD_CTX_free(hctx);
    EVP_PKEY_free(pkey);
    if (CRYPTO_memcmp(hmac, mdin, SHA256_DIGEST_LENGTH) != 0) {
        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_COOKIE_MISMATCH);
        return 0;
    }
    if (!PACKET_get_net_2(&cookie, &format)) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_LENGTH_MISMATCH);
        return 0;
    }
    if (format != COOKIE_STATE_FORMAT_VERSION)
        return 1;
    if (!PACKET_get_net_2(&cookie, &version)) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_LENGTH_MISMATCH);
        return 0;
    }
    if (version != TLS1_3_VERSION) {
        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
        return 0;
    }
    if (!PACKET_get_net_2(&cookie, &group_id)) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_LENGTH_MISMATCH);
        return 0;
    }
    ciphdata = PACKET_data(&cookie);
    if (!PACKET_forward(&cookie, 2)) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_LENGTH_MISMATCH);
        return 0;
    }
    if (group_id != s->s3->group_id
            || s->s3->tmp.new_cipher
               != ssl_get_cipher_by_char(s, ciphdata, 0)) {
        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_BAD_CIPHER);
        return 0;
    }
    if (!PACKET_get_1(&cookie, &key_share)
            || !PACKET_get_net_4(&cookie, &tm)
            || !PACKET_get_length_prefixed_2(&cookie, &chhash)
            || !PACKET_get_length_prefixed_1(&cookie, &appcookie)
            || PACKET_remaining(&cookie) != SHA256_DIGEST_LENGTH) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_LENGTH_MISMATCH);
        return 0;
    }
    now = (unsigned long)time(NULL);
    if (tm > now || (now - tm) > 600) {
        return 1;
    }
    if (s->ctx->verify_stateless_cookie_cb(s, PACKET_data(&appcookie),
                                     PACKET_remaining(&appcookie)) == 0) {
        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 SSL_R_COOKIE_MISMATCH);
        return 0;
    }
    if (!WPACKET_init_static_len(&hrrpkt, hrr, sizeof(hrr), 0)) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 ERR_R_INTERNAL_ERROR);
        return 0;
    }
    if (!WPACKET_put_bytes_u8(&hrrpkt, SSL3_MT_SERVER_HELLO)
            || !WPACKET_start_sub_packet_u24(&hrrpkt)
            || !WPACKET_put_bytes_u16(&hrrpkt, TLS1_2_VERSION)
            || !WPACKET_memcpy(&hrrpkt, hrrrandom, SSL3_RANDOM_SIZE)
            || !WPACKET_sub_memcpy_u8(&hrrpkt, s->tmp_session_id,
                                      s->tmp_session_id_len)
            || !s->method->put_cipher_by_char(s->s3->tmp.new_cipher, &hrrpkt,
                                              &ciphlen)
            || !WPACKET_put_bytes_u8(&hrrpkt, 0)
            || !WPACKET_start_sub_packet_u16(&hrrpkt)) {
        WPACKET_cleanup(&hrrpkt);
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 ERR_R_INTERNAL_ERROR);
        return 0;
    }
    if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_supported_versions)
            || !WPACKET_start_sub_packet_u16(&hrrpkt)
            || !WPACKET_put_bytes_u16(&hrrpkt, TLS1_3_VERSION_DRAFT)
            || !WPACKET_close(&hrrpkt)) {
        WPACKET_cleanup(&hrrpkt);
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 ERR_R_INTERNAL_ERROR);
        return 0;
    }
    if (key_share) {
        if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_key_share)
                || !WPACKET_start_sub_packet_u16(&hrrpkt)
                || !WPACKET_put_bytes_u16(&hrrpkt, s->s3->group_id)
                || !WPACKET_close(&hrrpkt)) {
            WPACKET_cleanup(&hrrpkt);
            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                     ERR_R_INTERNAL_ERROR);
            return 0;
        }
    }
    if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_cookie)
            || !WPACKET_start_sub_packet_u16(&hrrpkt)
            || !WPACKET_sub_memcpy_u16(&hrrpkt, data, rawlen)
            || !WPACKET_close(&hrrpkt)
            || !WPACKET_close(&hrrpkt)
            || !WPACKET_close(&hrrpkt)
            || !WPACKET_get_total_written(&hrrpkt, &hrrlen)
            || !WPACKET_finish(&hrrpkt)) {
        WPACKET_cleanup(&hrrpkt);
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
                 ERR_R_INTERNAL_ERROR);
        return 0;
    }
    if (!create_synthetic_message_hash(s, PACKET_data(&chhash),
                                       PACKET_remaining(&chhash), hrr,
                                       hrrlen)) {
        return 0;
    }
    s->hello_retry_request = 1;
    s->ext.cookieok = 1;
    return 1;
}
['int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,\n                          size_t chainidx)\n{\n    unsigned int format, version, key_share, group_id;\n    EVP_MD_CTX *hctx;\n    EVP_PKEY *pkey;\n    PACKET cookie, raw, chhash, appcookie;\n    WPACKET hrrpkt;\n    const unsigned char *data, *mdin, *ciphdata;\n    unsigned char hmac[SHA256_DIGEST_LENGTH];\n    unsigned char hrr[MAX_HRR_SIZE];\n    size_t rawlen, hmaclen, hrrlen, ciphlen;\n    unsigned long tm, now;\n    if (s->ctx->verify_stateless_cookie_cb == NULL\n            || (s->s3->flags & TLS1_FLAGS_STATELESS) == 0)\n        return 1;\n    if (!PACKET_as_length_prefixed_2(pkt, &cookie)) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_LENGTH_MISMATCH);\n        return 0;\n    }\n    raw = cookie;\n    data = PACKET_data(&raw);\n    rawlen = PACKET_remaining(&raw);\n    if (rawlen < SHA256_DIGEST_LENGTH\n            || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_LENGTH_MISMATCH);\n        return 0;\n    }\n    mdin = PACKET_data(&raw);\n    hctx = EVP_MD_CTX_create();\n    pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,\n                                        s->session_ctx->ext.cookie_hmac_key,\n                                        sizeof(s->session_ctx->ext\n                                               .cookie_hmac_key));\n    if (hctx == NULL || pkey == NULL) {\n        EVP_MD_CTX_free(hctx);\n        EVP_PKEY_free(pkey);\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    hmaclen = SHA256_DIGEST_LENGTH;\n    if (EVP_DigestSignInit(hctx, NULL, EVP_sha256(), NULL, pkey) <= 0\n            || EVP_DigestSign(hctx, hmac, &hmaclen, data,\n                              rawlen - SHA256_DIGEST_LENGTH) <= 0\n            || hmaclen != SHA256_DIGEST_LENGTH) {\n        EVP_MD_CTX_free(hctx);\n        EVP_PKEY_free(pkey);\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    EVP_MD_CTX_free(hctx);\n    EVP_PKEY_free(pkey);\n    if (CRYPTO_memcmp(hmac, mdin, SHA256_DIGEST_LENGTH) != 0) {\n        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_COOKIE_MISMATCH);\n        return 0;\n    }\n    if (!PACKET_get_net_2(&cookie, &format)) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_LENGTH_MISMATCH);\n        return 0;\n    }\n    if (format != COOKIE_STATE_FORMAT_VERSION)\n        return 1;\n    if (!PACKET_get_net_2(&cookie, &version)) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_LENGTH_MISMATCH);\n        return 0;\n    }\n    if (version != TLS1_3_VERSION) {\n        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_BAD_PROTOCOL_VERSION_NUMBER);\n        return 0;\n    }\n    if (!PACKET_get_net_2(&cookie, &group_id)) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_LENGTH_MISMATCH);\n        return 0;\n    }\n    ciphdata = PACKET_data(&cookie);\n    if (!PACKET_forward(&cookie, 2)) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_LENGTH_MISMATCH);\n        return 0;\n    }\n    if (group_id != s->s3->group_id\n            || s->s3->tmp.new_cipher\n               != ssl_get_cipher_by_char(s, ciphdata, 0)) {\n        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_BAD_CIPHER);\n        return 0;\n    }\n    if (!PACKET_get_1(&cookie, &key_share)\n            || !PACKET_get_net_4(&cookie, &tm)\n            || !PACKET_get_length_prefixed_2(&cookie, &chhash)\n            || !PACKET_get_length_prefixed_1(&cookie, &appcookie)\n            || PACKET_remaining(&cookie) != SHA256_DIGEST_LENGTH) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_LENGTH_MISMATCH);\n        return 0;\n    }\n    now = (unsigned long)time(NULL);\n    if (tm > now || (now - tm) > 600) {\n        return 1;\n    }\n    if (s->ctx->verify_stateless_cookie_cb(s, PACKET_data(&appcookie),\n                                     PACKET_remaining(&appcookie)) == 0) {\n        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 SSL_R_COOKIE_MISMATCH);\n        return 0;\n    }\n    if (!WPACKET_init_static_len(&hrrpkt, hrr, sizeof(hrr), 0)) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (!WPACKET_put_bytes_u8(&hrrpkt, SSL3_MT_SERVER_HELLO)\n            || !WPACKET_start_sub_packet_u24(&hrrpkt)\n            || !WPACKET_put_bytes_u16(&hrrpkt, TLS1_2_VERSION)\n            || !WPACKET_memcpy(&hrrpkt, hrrrandom, SSL3_RANDOM_SIZE)\n            || !WPACKET_sub_memcpy_u8(&hrrpkt, s->tmp_session_id,\n                                      s->tmp_session_id_len)\n            || !s->method->put_cipher_by_char(s->s3->tmp.new_cipher, &hrrpkt,\n                                              &ciphlen)\n            || !WPACKET_put_bytes_u8(&hrrpkt, 0)\n            || !WPACKET_start_sub_packet_u16(&hrrpkt)) {\n        WPACKET_cleanup(&hrrpkt);\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_supported_versions)\n            || !WPACKET_start_sub_packet_u16(&hrrpkt)\n            || !WPACKET_put_bytes_u16(&hrrpkt, TLS1_3_VERSION_DRAFT)\n            || !WPACKET_close(&hrrpkt)) {\n        WPACKET_cleanup(&hrrpkt);\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (key_share) {\n        if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_key_share)\n                || !WPACKET_start_sub_packet_u16(&hrrpkt)\n                || !WPACKET_put_bytes_u16(&hrrpkt, s->s3->group_id)\n                || !WPACKET_close(&hrrpkt)) {\n            WPACKET_cleanup(&hrrpkt);\n            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                     ERR_R_INTERNAL_ERROR);\n            return 0;\n        }\n    }\n    if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_cookie)\n            || !WPACKET_start_sub_packet_u16(&hrrpkt)\n            || !WPACKET_sub_memcpy_u16(&hrrpkt, data, rawlen)\n            || !WPACKET_close(&hrrpkt)\n            || !WPACKET_close(&hrrpkt)\n            || !WPACKET_close(&hrrpkt)\n            || !WPACKET_get_total_written(&hrrpkt, &hrrlen)\n            || !WPACKET_finish(&hrrpkt)) {\n        WPACKET_cleanup(&hrrpkt);\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (!create_synthetic_message_hash(s, PACKET_data(&chhash),\n                                       PACKET_remaining(&chhash), hrr,\n                                       hrrlen)) {\n        return 0;\n    }\n    s->hello_retry_request = 1;\n    s->ext.cookieok = 1;\n    return 1;\n}', 'static ossl_inline const unsigned char *PACKET_data(const PACKET *pkt)\n{\n    return pkt->curr;\n}', 'static ossl_inline size_t PACKET_remaining(const PACKET *pkt)\n{\n    return pkt->remaining;\n}', 'static ossl_inline int PACKET_forward(PACKET *pkt, size_t len)\n{\n    if (PACKET_remaining(pkt) < len)\n        return 0;\n    packet_forward(pkt, len);\n    return 1;\n}', 'static ossl_inline void packet_forward(PACKET *pkt, size_t len)\n{\n    pkt->curr += len;\n    pkt->remaining -= len;\n}', 'EVP_MD_CTX *EVP_MD_CTX_new(void)\n{\n    return OPENSSL_zalloc(sizeof(EVP_MD_CTX));\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    FAILTEST();\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    INCREMENT(malloc_count);\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    if (allow_customize) {\n        allow_customize = 0;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}', 'EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,\n                                       const unsigned char *priv,\n                                       size_t len)\n{\n    EVP_PKEY *ret = EVP_PKEY_new();\n    if (ret == NULL\n            || !pkey_set_type(ret, e, type, NULL, -1)) {\n        goto err;\n    }\n    if (ret->ameth->set_priv_key == NULL) {\n        EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PRIVATE_KEY,\n               EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);\n        goto err;\n    }\n    if (!ret->ameth->set_priv_key(ret, priv, len)) {\n        EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PRIVATE_KEY, EVP_R_KEY_SETUP_FAILED);\n        goto err;\n    }\n    return ret;\n err:\n    EVP_PKEY_free(ret);\n    return NULL;\n}', 'void EVP_PKEY_free(EVP_PKEY *x)\n{\n    int i;\n    if (x == NULL)\n        return;\n    CRYPTO_DOWN_REF(&x->references, &i, x->lock);\n    REF_PRINT_COUNT("EVP_PKEY", x);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    EVP_PKEY_free_it(x);\n    CRYPTO_THREAD_lock_free(x->lock);\n    sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);\n    OPENSSL_free(x);\n}', 'void EVP_MD_CTX_free(EVP_MD_CTX *ctx)\n{\n    EVP_MD_CTX_reset(ctx);\n    OPENSSL_free(ctx);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']