crypto/ct/ct_vfy.c:283: error: MEMORY_LEAK
  memory dynamically allocated by call to `SCT_CTX_new()` at line 262, column 12 is not reachable after line 283, column 5.
Showing all 142 steps of the trace


crypto/ct/ct_vfy.c:246:1: start of procedure SCT_verify_v1()
244.   }
245.   
246. > int SCT_verify_v1(SCT *sct, X509 *cert, X509 *preissuer,
247.                     X509_PUBKEY *log_pubkey, X509 *issuer_cert)
248.   {

crypto/ct/ct_vfy.c:249:5: 
247.                     X509_PUBKEY *log_pubkey, X509 *issuer_cert)
248.   {
249. >     int ret = 0;
250.       SCT_CTX *sctx = NULL;
251.   

crypto/ct/ct_vfy.c:250:5: 
248.   {
249.       int ret = 0;
250. >     SCT_CTX *sctx = NULL;
251.   
252.       if (!SCT_is_complete(sct)) {

crypto/ct/ct_vfy.c:252:10: 
250.       SCT_CTX *sctx = NULL;
251.   
252. >     if (!SCT_is_complete(sct)) {
253.           CTerr(CT_F_SCT_VERIFY_V1, CT_R_SCT_NOT_SET);
254.           return -1;

crypto/ct/ct_sct.c:281:1: start of procedure SCT_is_complete()
  279.   }
  280.   
  281. > int SCT_is_complete(const SCT *sct)
  282.   {
  283.       switch (sct->version) {

crypto/ct/ct_sct.c:283:5: 
  281.   int SCT_is_complete(const SCT *sct)
  282.   {
  283. >     switch (sct->version) {
  284.       case SCT_VERSION_NOT_SET:
  285.           return 0;

crypto/ct/ct_sct.c:284:5: Switch condition is false. Skipping switch case
  282.   {
  283.       switch (sct->version) {
  284.       case SCT_VERSION_NOT_SET:
             ^
  285.           return 0;
  286.       case SCT_VERSION_V1:

crypto/ct/ct_sct.c:286:5: Switch condition is true. Entering switch case
  284.       case SCT_VERSION_NOT_SET:
  285.           return 0;
  286.       case SCT_VERSION_V1:
             ^
  287.           return sct->log_id != NULL && SCT_signature_is_complete(sct);
  288.       default:

crypto/ct/ct_sct.c:287:16: Condition is true
  285.           return 0;
  286.       case SCT_VERSION_V1:
  287.           return sct->log_id != NULL && SCT_signature_is_complete(sct);
                        ^
  288.       default:
  289.           return sct->sct != NULL; /* Just need cached encoding */

crypto/ct/ct_sct.c:287:39: 
  285.           return 0;
  286.       case SCT_VERSION_V1:
  287. >         return sct->log_id != NULL && SCT_signature_is_complete(sct);
  288.       default:
  289.           return sct->sct != NULL; /* Just need cached encoding */

crypto/ct/ct_sct.c:293:1: start of procedure SCT_signature_is_complete()
    291.   }
    292.   
    293. > int SCT_signature_is_complete(const SCT *sct)
    294.   {
    295.       return SCT_get_signature_nid(sct) != NID_undef &&

crypto/ct/ct_sct.c:295:12: 
    293.   int SCT_signature_is_complete(const SCT *sct)
    294.   {
    295. >     return SCT_get_signature_nid(sct) != NID_undef &&
    296.           sct->sig != NULL && sct->sig_len > 0;
    297.   }

crypto/ct/ct_sct.c:252:1: start of procedure SCT_get_signature_nid()
      250.   }
      251.   
      252. > int SCT_get_signature_nid(const SCT *sct)
      253.   {
      254.       if (sct->version == SCT_VERSION_V1) {

crypto/ct/ct_sct.c:254:9: Taking true branch
      252.   int SCT_get_signature_nid(const SCT *sct)
      253.   {
      254.       if (sct->version == SCT_VERSION_V1) {
                     ^
      255.           if (sct->hash_alg == TLSEXT_hash_sha256) {
      256.               switch (sct->sig_alg) {

crypto/ct/ct_sct.c:255:13: Taking true branch
      253.   {
      254.       if (sct->version == SCT_VERSION_V1) {
      255.           if (sct->hash_alg == TLSEXT_hash_sha256) {
                         ^
      256.               switch (sct->sig_alg) {
      257.               case TLSEXT_signature_ecdsa:

crypto/ct/ct_sct.c:256:13: 
      254.       if (sct->version == SCT_VERSION_V1) {
      255.           if (sct->hash_alg == TLSEXT_hash_sha256) {
      256. >             switch (sct->sig_alg) {
      257.               case TLSEXT_signature_ecdsa:
      258.                   return NID_ecdsa_with_SHA256;

crypto/ct/ct_sct.c:257:13: Switch condition is true. Entering switch case
      255.           if (sct->hash_alg == TLSEXT_hash_sha256) {
      256.               switch (sct->sig_alg) {
      257.               case TLSEXT_signature_ecdsa:
                         ^
      258.                   return NID_ecdsa_with_SHA256;
      259.               case TLSEXT_signature_rsa:

crypto/ct/ct_sct.c:258:17: 
      256.               switch (sct->sig_alg) {
      257.               case TLSEXT_signature_ecdsa:
      258. >                 return NID_ecdsa_with_SHA256;
      259.               case TLSEXT_signature_rsa:
      260.                   return NID_sha256WithRSAEncryption;

crypto/ct/ct_sct.c:267:1: return from a call to SCT_get_signature_nid
      265.       }
      266.       return NID_undef;
      267. > }
      268.   
      269.   size_t SCT_get0_extensions(const SCT *sct, unsigned char **ext)

crypto/ct/ct_sct.c:295:12: Condition is true
    293.   int SCT_signature_is_complete(const SCT *sct)
    294.   {
    295.       return SCT_get_signature_nid(sct) != NID_undef &&
                      ^
    296.           sct->sig != NULL && sct->sig_len > 0;
    297.   }

crypto/ct/ct_sct.c:296:9: Condition is true
    294.   {
    295.       return SCT_get_signature_nid(sct) != NID_undef &&
    296.           sct->sig != NULL && sct->sig_len > 0;
                   ^
    297.   }
    298.   

crypto/ct/ct_sct.c:296:29: Condition is true
    294.   {
    295.       return SCT_get_signature_nid(sct) != NID_undef &&
    296.           sct->sig != NULL && sct->sig_len > 0;
                                       ^
    297.   }
    298.   

crypto/ct/ct_sct.c:295:12: 
    293.   int SCT_signature_is_complete(const SCT *sct)
    294.   {
    295. >     return SCT_get_signature_nid(sct) != NID_undef &&
    296.           sct->sig != NULL && sct->sig_len > 0;
    297.   }

crypto/ct/ct_sct.c:295:5: 
    293.   int SCT_signature_is_complete(const SCT *sct)
    294.   {
    295. >     return SCT_get_signature_nid(sct) != NID_undef &&
    296.           sct->sig != NULL && sct->sig_len > 0;
    297.   }

crypto/ct/ct_sct.c:297:1: return from a call to SCT_signature_is_complete
    295.       return SCT_get_signature_nid(sct) != NID_undef &&
    296.           sct->sig != NULL && sct->sig_len > 0;
    297. > }
    298.   
    299.   sct_source_t SCT_get_source(const SCT *sct)

crypto/ct/ct_sct.c:287:39: Condition is true
  285.           return 0;
  286.       case SCT_VERSION_V1:
  287.           return sct->log_id != NULL && SCT_signature_is_complete(sct);
                                               ^
  288.       default:
  289.           return sct->sct != NULL; /* Just need cached encoding */

crypto/ct/ct_sct.c:287:16: 
  285.           return 0;
  286.       case SCT_VERSION_V1:
  287. >         return sct->log_id != NULL && SCT_signature_is_complete(sct);
  288.       default:
  289.           return sct->sct != NULL; /* Just need cached encoding */

crypto/ct/ct_sct.c:287:9: 
  285.           return 0;
  286.       case SCT_VERSION_V1:
  287. >         return sct->log_id != NULL && SCT_signature_is_complete(sct);
  288.       default:
  289.           return sct->sct != NULL; /* Just need cached encoding */

crypto/ct/ct_sct.c:291:1: return from a call to SCT_is_complete
  289.           return sct->sct != NULL; /* Just need cached encoding */
  290.       }
  291. > }
  292.   
  293.   int SCT_signature_is_complete(const SCT *sct)

crypto/ct/ct_vfy.c:252:10: Taking false branch
250.       SCT_CTX *sctx = NULL;
251.   
252.       if (!SCT_is_complete(sct)) {
                ^
253.           CTerr(CT_F_SCT_VERIFY_V1, CT_R_SCT_NOT_SET);
254.           return -1;

crypto/ct/ct_vfy.c:257:9: Taking false branch
255.       }
256.   
257.       if (sct->version != 0) {
               ^
258.           CTerr(CT_F_SCT_VERIFY_V1, CT_R_SCT_UNSUPPORTED_VERSION);
259.           return 0;

crypto/ct/ct_vfy.c:262:5: 
260.       }
261.   
262. >     sctx = SCT_CTX_new();
263.       if (sctx == NULL)
264.           goto done;

crypto/ct/ct_sct_ctx.c:72:1: start of procedure SCT_CTX_new()
  70.   #include "ct_locl.h"
  71.   
  72. > SCT_CTX *SCT_CTX_new(void)
  73.   {
  74.       SCT_CTX *sctx = OPENSSL_zalloc(sizeof(*sctx));

crypto/ct/ct_sct_ctx.c:74:5: 
  72.   SCT_CTX *SCT_CTX_new(void)
  73.   {
  74. >     SCT_CTX *sctx = OPENSSL_zalloc(sizeof(*sctx));
  75.   
  76.       if (sctx == NULL)

crypto/mem.c:146:1: start of procedure CRYPTO_zalloc()
    144.   }
    145.   
    146. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    147.   {
    148.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:148:5: 
    146.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    147.   {
    148. >     void *ret = CRYPTO_malloc(num, file, line);
    149.   
    150.       if (ret != NULL)

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                     ^
      124.           return malloc_impl(num, file, line);
      125.   

crypto/mem.c:126:9: Taking false branch
      124.           return malloc_impl(num, file, line);
      125.   
      126.       if (num <= 0)
                     ^
      127.           return NULL;
      128.   

crypto/mem.c:129:5: 
      127.           return NULL;
      128.   
      129. >     allow_customize = 0;
      130.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      131.       if (call_malloc_debug) {

crypto/mem.c:139:5: 
      137.       }
      138.   #else
      139. >     osslargused(file); osslargused(line);
      140.       ret = malloc(num);
      141.   #endif

crypto/mem.c:139:24: 
      137.       }
      138.   #else
      139. >     osslargused(file); osslargused(line);
      140.       ret = malloc(num);
      141.   #endif

crypto/mem.c:140:5: 
      138.   #else
      139.       osslargused(file); osslargused(line);
      140. >     ret = malloc(num);
      141.   #endif
      142.   

crypto/mem.c:143:5: 
      141.   #endif
      142.   
      143. >     return ret;
      144.   }
      145.   

crypto/mem.c:144:1: return from a call to CRYPTO_malloc
      142.   
      143.       return ret;
      144. > }
      145.   
      146.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:150:9: Taking true branch
    148.       void *ret = CRYPTO_malloc(num, file, line);
    149.   
    150.       if (ret != NULL)
                   ^
    151.           memset(ret, 0, num);
    152.       return ret;

crypto/mem.c:151:9: 
    149.   
    150.       if (ret != NULL)
    151. >         memset(ret, 0, num);
    152.       return ret;
    153.   }

crypto/mem.c:152:5: 
    150.       if (ret != NULL)
    151.           memset(ret, 0, num);
    152. >     return ret;
    153.   }
    154.   

crypto/mem.c:153:1: return from a call to CRYPTO_zalloc
    151.           memset(ret, 0, num);
    152.       return ret;
    153. > }
    154.   
    155.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/ct/ct_sct_ctx.c:76:9: Taking false branch
  74.       SCT_CTX *sctx = OPENSSL_zalloc(sizeof(*sctx));
  75.   
  76.       if (sctx == NULL)
                ^
  77.           CTerr(CT_F_SCT_CTX_NEW, ERR_R_MALLOC_FAILURE);
  78.   

crypto/ct/ct_sct_ctx.c:79:5: 
  77.           CTerr(CT_F_SCT_CTX_NEW, ERR_R_MALLOC_FAILURE);
  78.   
  79. >     return sctx;
  80.   }
  81.   

crypto/ct/ct_sct_ctx.c:80:1: return from a call to SCT_CTX_new
  78.   
  79.       return sctx;
  80. > }
  81.   
  82.   void SCT_CTX_free(SCT_CTX *sctx)

crypto/ct/ct_vfy.c:263:9: Taking false branch
261.   
262.       sctx = SCT_CTX_new();
263.       if (sctx == NULL)
               ^
264.           goto done;
265.   

crypto/ct/ct_vfy.c:266:5: 
264.           goto done;
265.   
266. >     ret = SCT_CTX_set1_pubkey(sctx, log_pubkey);
267.       if (ret <= 0)
268.           goto done;

crypto/ct/ct_sct_ctx.c:283:1: start of procedure SCT_CTX_set1_pubkey()
  281.   }
  282.   
  283. > int SCT_CTX_set1_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey)
  284.   {
  285.       EVP_PKEY *pkey = X509_PUBKEY_get(pubkey);

crypto/ct/ct_sct_ctx.c:285:5: Skipping X509_PUBKEY_get(): empty list of specs
  283.   int SCT_CTX_set1_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey)
  284.   {
  285.       EVP_PKEY *pkey = X509_PUBKEY_get(pubkey);
             ^
  286.   
  287.       if (pkey == NULL)

crypto/ct/ct_sct_ctx.c:287:9: Taking false branch
  285.       EVP_PKEY *pkey = X509_PUBKEY_get(pubkey);
  286.   
  287.       if (pkey == NULL)
                 ^
  288.           return 0;
  289.   

crypto/ct/ct_sct_ctx.c:290:10: Taking false branch
  288.           return 0;
  289.   
  290.       if (!ct_public_key_hash(pubkey, &sctx->pkeyhash, &sctx->pkeyhashlen)) {
                  ^
  291.           EVP_PKEY_free(pkey);
  292.           return 0;

crypto/ct/ct_sct_ctx.c:295:5: 
  293.       }
  294.   
  295. >     EVP_PKEY_free(sctx->pkey);
  296.       sctx->pkey = pkey;
  297.       return 1;

crypto/evp/p_lib.c:412:1: start of procedure EVP_PKEY_free()
    410.   }
    411.   
    412. > void EVP_PKEY_free(EVP_PKEY *x)
    413.   {
    414.       int i;

crypto/evp/p_lib.c:416:9: Taking false branch
    414.       int i;
    415.   
    416.       if (x == NULL)
                   ^
    417.           return;
    418.   

crypto/evp/p_lib.c:419:5: 
    417.           return;
    418.   
    419. >     i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_EVP_PKEY);
    420.       REF_PRINT_COUNT("EVP_PKEY", x);
    421.       if (i > 0)

crypto/lock.c:456:1: start of procedure CRYPTO_add_lock()
      454.   }
      455.   
      456. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
      457.                       int line)
      458.   {

crypto/lock.c:459:5: 
      457.                       int line)
      458.   {
      459. >     int ret = 0;
      460.   
      461.       if (add_lock_callback != NULL) {

crypto/lock.c:461:9: Taking false branch
      459.       int ret = 0;
      460.   
      461.       if (add_lock_callback != NULL) {
                     ^
      462.   #ifdef LOCK_DEBUG
      463.           int before = *pointer;

crypto/lock.c:477:9: 
      475.   #endif
      476.       } else {
      477. >         CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
      478.   
      479.           ret = *pointer + amount;

crypto/lock.c:414:1: start of procedure CRYPTO_lock()
        412.   }
        413.   
        414. > void CRYPTO_lock(int mode, int type, const char *file, int line)
        415.   {
        416.   #ifdef LOCK_DEBUG

crypto/lock.c:441:9: Taking false branch
        439.       }
        440.   #endif
        441.       if (type < 0) {
                       ^
        442.           if (dynlock_lock_callback != NULL) {
        443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:452:16: Taking false branch
        450.               CRYPTO_destroy_dynlockid(type);
        451.           }
        452.       } else if (locking_callback != NULL)
                              ^
        453.           locking_callback(mode, type, file, line);
        454.   }

crypto/lock.c:441:5: 
        439.       }
        440.   #endif
        441. >     if (type < 0) {
        442.           if (dynlock_lock_callback != NULL) {
        443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:454:1: return from a call to CRYPTO_lock
        452.       } else if (locking_callback != NULL)
        453.           locking_callback(mode, type, file, line);
        454. > }
        455.   
        456.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/lock.c:479:9: 
      477.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
      478.   
      479. >         ret = *pointer + amount;
      480.   #ifdef LOCK_DEBUG
      481.           {

crypto/lock.c:490:9: 
      488.           }
      489.   #endif
      490. >         *pointer = ret;
      491.           CRYPTO_lock(CRYPTO_UNLOCK | CRYPTO_WRITE, type, file, line);
      492.       }

crypto/lock.c:491:9: 
      489.   #endif
      490.           *pointer = ret;
      491. >         CRYPTO_lock(CRYPTO_UNLOCK | CRYPTO_WRITE, type, file, line);
      492.       }
      493.       return (ret);

crypto/lock.c:414:1: start of procedure CRYPTO_lock()
        412.   }
        413.   
        414. > void CRYPTO_lock(int mode, int type, const char *file, int line)
        415.   {
        416.   #ifdef LOCK_DEBUG

crypto/lock.c:441:9: Taking false branch
        439.       }
        440.   #endif
        441.       if (type < 0) {
                       ^
        442.           if (dynlock_lock_callback != NULL) {
        443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:452:16: Taking false branch
        450.               CRYPTO_destroy_dynlockid(type);
        451.           }
        452.       } else if (locking_callback != NULL)
                              ^
        453.           locking_callback(mode, type, file, line);
        454.   }

crypto/lock.c:441:5: 
        439.       }
        440.   #endif
        441. >     if (type < 0) {
        442.           if (dynlock_lock_callback != NULL) {
        443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:454:1: return from a call to CRYPTO_lock
        452.       } else if (locking_callback != NULL)
        453.           locking_callback(mode, type, file, line);
        454. > }
        455.   
        456.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/lock.c:493:5: 
      491.           CRYPTO_lock(CRYPTO_UNLOCK | CRYPTO_WRITE, type, file, line);
      492.       }
      493. >     return (ret);
      494.   }
      495.   

crypto/lock.c:494:1: return from a call to CRYPTO_add_lock
      492.       }
      493.       return (ret);
      494. > }
      495.   
      496.   const char *CRYPTO_get_lock_name(int type)

crypto/evp/p_lib.c:421:9: Taking true branch
    419.       i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_EVP_PKEY);
    420.       REF_PRINT_COUNT("EVP_PKEY", x);
    421.       if (i > 0)
                   ^
    422.           return;
    423.       REF_ASSERT_ISNT(i < 0);

crypto/evp/p_lib.c:422:9: 
    420.       REF_PRINT_COUNT("EVP_PKEY", x);
    421.       if (i > 0)
    422. >         return;
    423.       REF_ASSERT_ISNT(i < 0);
    424.       EVP_PKEY_free_it(x);

crypto/evp/p_lib.c:427:1: return from a call to EVP_PKEY_free
    425.       sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
    426.       OPENSSL_free(x);
    427. > }
    428.   
    429.   static void EVP_PKEY_free_it(EVP_PKEY *x)

crypto/ct/ct_sct_ctx.c:296:5: 
  294.   
  295.       EVP_PKEY_free(sctx->pkey);
  296. >     sctx->pkey = pkey;
  297.       return 1;
  298.   }

crypto/ct/ct_sct_ctx.c:297:5: 
  295.       EVP_PKEY_free(sctx->pkey);
  296.       sctx->pkey = pkey;
  297. >     return 1;
  298.   }

crypto/ct/ct_sct_ctx.c:298:1: return from a call to SCT_CTX_set1_pubkey
  296.       sctx->pkey = pkey;
  297.       return 1;
  298. > }

crypto/ct/ct_vfy.c:267:9: Taking false branch
265.   
266.       ret = SCT_CTX_set1_pubkey(sctx, log_pubkey);
267.       if (ret <= 0)
               ^
268.           goto done;
269.   

crypto/ct/ct_vfy.c:270:5: 
268.           goto done;
269.   
270. >     ret = SCT_CTX_set1_cert(sctx, cert, preissuer);
271.       if (ret <= 0)
272.           goto done;

crypto/ct/ct_sct_ctx.c:158:1: start of procedure SCT_CTX_set1_cert()
  156.   }
  157.   
  158. > int SCT_CTX_set1_cert(SCT_CTX *sctx, X509 *cert, X509 *presigner)
  159.   {
  160.       unsigned char *certder = NULL, *preder = NULL;

crypto/ct/ct_sct_ctx.c:160:5: 
  158.   int SCT_CTX_set1_cert(SCT_CTX *sctx, X509 *cert, X509 *presigner)
  159.   {
  160. >     unsigned char *certder = NULL, *preder = NULL;
  161.       X509 *pretmp = NULL;
  162.       int certderlen = 0, prederlen = 0;

crypto/ct/ct_sct_ctx.c:161:5: 
  159.   {
  160.       unsigned char *certder = NULL, *preder = NULL;
  161. >     X509 *pretmp = NULL;
  162.       int certderlen = 0, prederlen = 0;
  163.       int idx = -1;

crypto/ct/ct_sct_ctx.c:162:5: 
  160.       unsigned char *certder = NULL, *preder = NULL;
  161.       X509 *pretmp = NULL;
  162. >     int certderlen = 0, prederlen = 0;
  163.       int idx = -1;
  164.       int poison_ext_is_dup, sct_ext_is_dup;

crypto/ct/ct_sct_ctx.c:163:5: 
  161.       X509 *pretmp = NULL;
  162.       int certderlen = 0, prederlen = 0;
  163. >     int idx = -1;
  164.       int poison_ext_is_dup, sct_ext_is_dup;
  165.       int poison_idx = ct_x509_get_ext(cert, NID_ct_precert_poison, &poison_ext_is_dup);

crypto/ct/ct_sct_ctx.c:165:5: Skipping ct_x509_get_ext(): empty list of specs
  163.       int idx = -1;
  164.       int poison_ext_is_dup, sct_ext_is_dup;
  165.       int poison_idx = ct_x509_get_ext(cert, NID_ct_precert_poison, &poison_ext_is_dup);
             ^
  166.   
  167.       /* Duplicate poison */

crypto/ct/ct_sct_ctx.c:168:9: Taking false branch
  166.   
  167.       /* Duplicate poison */
  168.       if (poison_ext_is_dup)
                 ^
  169.           goto err;
  170.   

crypto/ct/ct_sct_ctx.c:172:9: Taking false branch
  170.   
  171.       /* If no poison extension, store encoding */
  172.       if (poison_idx == -1) {
                 ^
  173.           /* presigner must have poison */
  174.           if (presigner != NULL)

crypto/ct/ct_sct_ctx.c:183:5: Skipping ct_x509_get_ext(): empty list of specs
  181.   
  182.       /* See if have precert scts extension */
  183.       idx = ct_x509_get_ext(cert, NID_ct_precert_scts, &sct_ext_is_dup);
             ^
  184.       /* Duplicate scts */
  185.       if (sct_ext_is_dup)

crypto/ct/ct_sct_ctx.c:185:9: Taking false branch
  183.       idx = ct_x509_get_ext(cert, NID_ct_precert_scts, &sct_ext_is_dup);
  184.       /* Duplicate scts */
  185.       if (sct_ext_is_dup)
                 ^
  186.           goto err;
  187.   

crypto/ct/ct_sct_ctx.c:188:9: Taking false branch
  186.           goto err;
  187.   
  188.       if (idx >= 0) {
                 ^
  189.           /* Can't have both poison and scts */
  190.           if (poison_idx >= 0)

crypto/ct/ct_sct_ctx.c:193:9: 
  191.               goto err;
  192.       } else {
  193. >         idx = poison_idx;
  194.       }
  195.   

crypto/ct/ct_sct_ctx.c:196:9: Taking false branch
  194.       }
  195.   
  196.       if (idx >= 0) {
                 ^
  197.           X509_EXTENSION *ext;
  198.   

crypto/ct/ct_sct_ctx.c:215:5: 
  213.       }
  214.   
  215. >     X509_free(pretmp);
  216.   
  217.       OPENSSL_free(sctx->certder);

crypto/x509/x_x509.c:132:1: start of procedure X509_free()
    130.   } ASN1_SEQUENCE_END_ref(X509, X509)
    131.   
    132. > IMPLEMENT_ASN1_FUNCTIONS(X509)
    133.   
    134.   IMPLEMENT_ASN1_DUP_FUNCTION(X509)

crypto/asn1/tasn_fre.c:70:1: start of procedure ASN1_item_free()
      68.   /* Free up an ASN1 structure */
      69.   
      70. > void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
      71.   {
      72.       asn1_item_embed_free(&val, it, 0);

crypto/asn1/tasn_fre.c:72:5: Skipping asn1_item_embed_free(): empty list of specs
      70.   void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
      71.   {
      72.       asn1_item_embed_free(&val, it, 0);
                ^
      73.   }
      74.   

crypto/asn1/tasn_fre.c:73:1: return from a call to ASN1_item_free
      71.   {
      72.       asn1_item_embed_free(&val, it, 0);
      73. > }
      74.   
      75.   void ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)

crypto/x509/x_x509.c:132:1: return from a call to X509_free
    130.   } ASN1_SEQUENCE_END_ref(X509, X509)
    131.   
    132. > IMPLEMENT_ASN1_FUNCTIONS(X509)
    133.   
    134.   IMPLEMENT_ASN1_DUP_FUNCTION(X509)

crypto/ct/ct_sct_ctx.c:217:5: 
  215.       X509_free(pretmp);
  216.   
  217. >     OPENSSL_free(sctx->certder);
  218.       sctx->certder = certder;
  219.       sctx->certderlen = certderlen;

crypto/mem.c:210:1: start of procedure CRYPTO_free()
    208.   }
    209.   
    210. > void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:212:9: Taking true branch
    210.   void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                   ^
    213.           free_impl(str, file, line);
    214.           return;

crypto/mem.c:212:30: Taking true branch
    210.   void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                                        ^
    213.           free_impl(str, file, line);
    214.           return;

crypto/mem.c:213:9: Skipping __function_pointer__(): unresolved function pointer
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
    213.           free_impl(str, file, line);
                   ^
    214.           return;
    215.       }

crypto/mem.c:214:9: 
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
    213.           free_impl(str, file, line);
    214. >         return;
    215.       }
    216.   

crypto/mem.c:228:1: return from a call to CRYPTO_free
    226.       free(str);
    227.   #endif
    228. > }
    229.   
    230.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

crypto/ct/ct_sct_ctx.c:218:5: 
  216.   
  217.       OPENSSL_free(sctx->certder);
  218. >     sctx->certder = certder;
  219.       sctx->certderlen = certderlen;
  220.   

crypto/ct/ct_sct_ctx.c:219:5: 
  217.       OPENSSL_free(sctx->certder);
  218.       sctx->certder = certder;
  219. >     sctx->certderlen = certderlen;
  220.   
  221.       OPENSSL_free(sctx->preder);

crypto/ct/ct_sct_ctx.c:221:5: 
  219.       sctx->certderlen = certderlen;
  220.   
  221. >     OPENSSL_free(sctx->preder);
  222.       sctx->preder = preder;
  223.       sctx->prederlen = prederlen;

crypto/mem.c:210:1: start of procedure CRYPTO_free()
    208.   }
    209.   
    210. > void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:212:9: Taking true branch
    210.   void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                   ^
    213.           free_impl(str, file, line);
    214.           return;

crypto/mem.c:212:30: Taking true branch
    210.   void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                                        ^
    213.           free_impl(str, file, line);
    214.           return;

crypto/mem.c:213:9: Skipping __function_pointer__(): unresolved function pointer
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
    213.           free_impl(str, file, line);
                   ^
    214.           return;
    215.       }

crypto/mem.c:214:9: 
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
    213.           free_impl(str, file, line);
    214. >         return;
    215.       }
    216.   

crypto/mem.c:228:1: return from a call to CRYPTO_free
    226.       free(str);
    227.   #endif
    228. > }
    229.   
    230.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

crypto/ct/ct_sct_ctx.c:222:5: 
  220.   
  221.       OPENSSL_free(sctx->preder);
  222. >     sctx->preder = preder;
  223.       sctx->prederlen = prederlen;
  224.   

crypto/ct/ct_sct_ctx.c:223:5: 
  221.       OPENSSL_free(sctx->preder);
  222.       sctx->preder = preder;
  223. >     sctx->prederlen = prederlen;
  224.   
  225.       return 1;

crypto/ct/ct_sct_ctx.c:225:5: 
  223.       sctx->prederlen = prederlen;
  224.   
  225. >     return 1;
  226.   err:
  227.       OPENSSL_free(certder);

crypto/ct/ct_sct_ctx.c:231:1: return from a call to SCT_CTX_set1_cert
  229.       X509_free(pretmp);
  230.       return 0;
  231. > }
  232.   
  233.   static int ct_public_key_hash(X509_PUBKEY *pkey, unsigned char **hash,

crypto/ct/ct_vfy.c:271:9: Taking false branch
269.   
270.       ret = SCT_CTX_set1_cert(sctx, cert, preissuer);
271.       if (ret <= 0)
               ^
272.           goto done;
273.   

crypto/ct/ct_vfy.c:274:9: Taking true branch
272.           goto done;
273.   
274.       if (sct->entry_type == CT_LOG_ENTRY_TYPE_PRECERT) {
               ^
275.           ret = SCT_CTX_set1_issuer(sctx, issuer_cert);
276.           if (ret <= 0)

crypto/ct/ct_vfy.c:275:9: 
273.   
274.       if (sct->entry_type == CT_LOG_ENTRY_TYPE_PRECERT) {
275. >         ret = SCT_CTX_set1_issuer(sctx, issuer_cert);
276.           if (ret <= 0)
277.               goto done;

crypto/ct/ct_sct_ctx.c:272:1: start of procedure SCT_CTX_set1_issuer()
  270.   }
  271.   
  272. > int SCT_CTX_set1_issuer(SCT_CTX *sctx, const X509 *issuer)
  273.   {
  274.       return ct_public_key_hash(X509_get_X509_PUBKEY(issuer), &sctx->ihash,

crypto/ct/ct_sct_ctx.c:274:5: 
  272.   int SCT_CTX_set1_issuer(SCT_CTX *sctx, const X509 *issuer)
  273.   {
  274. >     return ct_public_key_hash(X509_get_X509_PUBKEY(issuer), &sctx->ihash,
  275.                                 &sctx->ihashlen);
  276.   }

crypto/x509/x509_set.c:174:1: start of procedure X509_get_X509_PUBKEY()
    172.   }
    173.   
    174. > X509_PUBKEY *X509_get_X509_PUBKEY(const X509 *x)
    175.   {
    176.       return x->cert_info.key;

crypto/x509/x509_set.c:176:5: 
    174.   X509_PUBKEY *X509_get_X509_PUBKEY(const X509 *x)
    175.   {
    176. >     return x->cert_info.key;
    177.   }
    178.   

crypto/x509/x509_set.c:177:1: return from a call to X509_get_X509_PUBKEY
    175.   {
    176.       return x->cert_info.key;
    177. > }
    178.   
    179.   STACK_OF(X509_EXTENSION) *X509_get0_extensions(const X509 *x)

crypto/ct/ct_sct_ctx.c:274:5: Skipping ct_public_key_hash(): empty list of specs
  272.   int SCT_CTX_set1_issuer(SCT_CTX *sctx, const X509 *issuer)
  273.   {
  274.       return ct_public_key_hash(X509_get_X509_PUBKEY(issuer), &sctx->ihash,
             ^
  275.                                 &sctx->ihashlen);
  276.   }

crypto/ct/ct_sct_ctx.c:276:1: return from a call to SCT_CTX_set1_issuer
  274.       return ct_public_key_hash(X509_get_X509_PUBKEY(issuer), &sctx->ihash,
  275.                                 &sctx->ihashlen);
  276. > }
  277.   
  278.   int SCT_CTX_set1_issuer_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey)

crypto/ct/ct_vfy.c:276:13: Taking true branch
274.       if (sct->entry_type == CT_LOG_ENTRY_TYPE_PRECERT) {
275.           ret = SCT_CTX_set1_issuer(sctx, issuer_cert);
276.           if (ret <= 0)
                   ^
277.               goto done;
278.       }

crypto/ct/ct_vfy.c:282:1: 
280.       ret = SCT_verify(sctx, sct);
281.   
282. > done:
283.       SCT_CTX_free(sctx);
284.       return ret;

crypto/ct/ct_vfy.c:283:5: Skipping SCT_CTX_free(): empty list of specs
281.   
282.   done:
283.       SCT_CTX_free(sctx);
           ^
284.       return ret;
285.   }

int SCT_verify_v1(SCT *sct, X509 *cert, X509 *preissuer,
                  X509_PUBKEY *log_pubkey, X509 *issuer_cert)
{
    int ret = 0;
    SCT_CTX *sctx = NULL;
    if (!SCT_is_complete(sct)) {
        CTerr(CT_F_SCT_VERIFY_V1, CT_R_SCT_NOT_SET);
        return -1;
    }
    if (sct->version != 0) {
        CTerr(CT_F_SCT_VERIFY_V1, CT_R_SCT_UNSUPPORTED_VERSION);
        return 0;
    }
    sctx = SCT_CTX_new();
    if (sctx == NULL)
        goto done;
    ret = SCT_CTX_set1_pubkey(sctx, log_pubkey);
    if (ret <= 0)
        goto done;
    ret = SCT_CTX_set1_cert(sctx, cert, preissuer);
    if (ret <= 0)
        goto done;
    if (sct->entry_type == CT_LOG_ENTRY_TYPE_PRECERT) {
        ret = SCT_CTX_set1_issuer(sctx, issuer_cert);
        if (ret <= 0)
            goto done;
    }
    ret = SCT_verify(sctx, sct);
done:
    SCT_CTX_free(sctx);
    return ret;
}
['int SCT_verify_v1(SCT *sct, X509 *cert, X509 *preissuer,\n                  X509_PUBKEY *log_pubkey, X509 *issuer_cert)\n{\n    int ret = 0;\n    SCT_CTX *sctx = NULL;\n    if (!SCT_is_complete(sct)) {\n        CTerr(CT_F_SCT_VERIFY_V1, CT_R_SCT_NOT_SET);\n        return -1;\n    }\n    if (sct->version != 0) {\n        CTerr(CT_F_SCT_VERIFY_V1, CT_R_SCT_UNSUPPORTED_VERSION);\n        return 0;\n    }\n    sctx = SCT_CTX_new();\n    if (sctx == NULL)\n        goto done;\n    ret = SCT_CTX_set1_pubkey(sctx, log_pubkey);\n    if (ret <= 0)\n        goto done;\n    ret = SCT_CTX_set1_cert(sctx, cert, preissuer);\n    if (ret <= 0)\n        goto done;\n    if (sct->entry_type == CT_LOG_ENTRY_TYPE_PRECERT) {\n        ret = SCT_CTX_set1_issuer(sctx, issuer_cert);\n        if (ret <= 0)\n            goto done;\n    }\n    ret = SCT_verify(sctx, sct);\ndone:\n    SCT_CTX_free(sctx);\n    return ret;\n}', 'int SCT_is_complete(const SCT *sct)\n{\n    switch (sct->version) {\n    case SCT_VERSION_NOT_SET:\n        return 0;\n    case SCT_VERSION_V1:\n        return sct->log_id != NULL && SCT_signature_is_complete(sct);\n    default:\n        return sct->sct != NULL;\n    }\n}', 'int SCT_signature_is_complete(const SCT *sct)\n{\n    return SCT_get_signature_nid(sct) != NID_undef &&\n        sct->sig != NULL && sct->sig_len > 0;\n}', 'int SCT_get_signature_nid(const SCT *sct)\n{\n    if (sct->version == SCT_VERSION_V1) {\n        if (sct->hash_alg == TLSEXT_hash_sha256) {\n            switch (sct->sig_alg) {\n            case TLSEXT_signature_ecdsa:\n                return NID_ecdsa_with_SHA256;\n            case TLSEXT_signature_rsa:\n                return NID_sha256WithRSAEncryption;\n            default:\n                return NID_undef;\n            }\n        }\n    }\n    return NID_undef;\n}', 'SCT_CTX *SCT_CTX_new(void)\n{\n    SCT_CTX *sctx = OPENSSL_zalloc(sizeof(*sctx));\n    if (sctx == NULL)\n        CTerr(CT_F_SCT_CTX_NEW, ERR_R_MALLOC_FAILURE);\n    return sctx;\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}', 'int SCT_CTX_set1_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey)\n{\n    EVP_PKEY *pkey = X509_PUBKEY_get(pubkey);\n    if (pkey == NULL)\n        return 0;\n    if (!ct_public_key_hash(pubkey, &sctx->pkeyhash, &sctx->pkeyhashlen)) {\n        EVP_PKEY_free(pkey);\n        return 0;\n    }\n    EVP_PKEY_free(sctx->pkey);\n    sctx->pkey = pkey;\n    return 1;\n}', 'void EVP_PKEY_free(EVP_PKEY *x)\n{\n    int i;\n    if (x == NULL)\n        return;\n    i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_EVP_PKEY);\n    REF_PRINT_COUNT("EVP_PKEY", x);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    EVP_PKEY_free_it(x);\n    sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);\n    OPENSSL_free(x);\n}', 'int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,\n                    int line)\n{\n    int ret = 0;\n    if (add_lock_callback != NULL) {\n#ifdef LOCK_DEBUG\n        int before = *pointer;\n#endif\n        ret = add_lock_callback(pointer, amount, type, file, line);\n#ifdef LOCK_DEBUG\n        {\n            CRYPTO_THREADID id;\n            CRYPTO_THREADID_current(&id);\n            fprintf(stderr, "ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n                    CRYPTO_THREADID_hash(&id), before, amount, ret,\n                    CRYPTO_get_lock_name(type), file, line);\n        }\n#endif\n    } else {\n        CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);\n        ret = *pointer + amount;\n#ifdef LOCK_DEBUG\n        {\n            CRYPTO_THREADID id;\n            CRYPTO_THREADID_current(&id);\n            fprintf(stderr, "ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n                    CRYPTO_THREADID_hash(&id),\n                    *pointer, amount, ret,\n                    CRYPTO_get_lock_name(type), file, line);\n        }\n#endif\n        *pointer = ret;\n        CRYPTO_lock(CRYPTO_UNLOCK | CRYPTO_WRITE, type, file, line);\n    }\n    return (ret);\n}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n{\n#ifdef LOCK_DEBUG\n    {\n        CRYPTO_THREADID id;\n        char *rw_text, *operation_text;\n        if (mode & CRYPTO_LOCK)\n            operation_text = "lock  ";\n        else if (mode & CRYPTO_UNLOCK)\n            operation_text = "unlock";\n        else\n            operation_text = "ERROR ";\n        if (mode & CRYPTO_READ)\n            rw_text = "r";\n        else if (mode & CRYPTO_WRITE)\n            rw_text = "w";\n        else\n            rw_text = "ERROR";\n        CRYPTO_THREADID_current(&id);\n        fprintf(stderr, "lock:%08lx:(%s)%s %-18s %s:%d\\n",\n                CRYPTO_THREADID_hash(&id), rw_text, operation_text,\n                CRYPTO_get_lock_name(type), file, line);\n    }\n#endif\n    if (type < 0) {\n        if (dynlock_lock_callback != NULL) {\n            struct CRYPTO_dynlock_value *pointer\n                = CRYPTO_get_dynlock_value(type);\n            OPENSSL_assert(pointer != NULL);\n            dynlock_lock_callback(mode, pointer, file, line);\n            CRYPTO_destroy_dynlockid(type);\n        }\n    } else if (locking_callback != NULL)\n        locking_callback(mode, type, file, line);\n}', 'int SCT_CTX_set1_cert(SCT_CTX *sctx, X509 *cert, X509 *presigner)\n{\n    unsigned char *certder = NULL, *preder = NULL;\n    X509 *pretmp = NULL;\n    int certderlen = 0, prederlen = 0;\n    int idx = -1;\n    int poison_ext_is_dup, sct_ext_is_dup;\n    int poison_idx = ct_x509_get_ext(cert, NID_ct_precert_poison, &poison_ext_is_dup);\n    if (poison_ext_is_dup)\n        goto err;\n    if (poison_idx == -1) {\n        if (presigner != NULL)\n            goto err;\n        certderlen = i2d_X509(cert, &certder);\n        if (certderlen < 0)\n            goto err;\n    }\n    idx = ct_x509_get_ext(cert, NID_ct_precert_scts, &sct_ext_is_dup);\n    if (sct_ext_is_dup)\n        goto err;\n    if (idx >= 0) {\n        if (poison_idx >= 0)\n            goto err;\n    } else {\n        idx = poison_idx;\n    }\n    if (idx >= 0) {\n        X509_EXTENSION *ext;\n        pretmp = X509_dup(cert);\n        if (pretmp == NULL)\n            goto err;\n        ext = X509_delete_ext(pretmp, idx);\n        X509_EXTENSION_free(ext);\n        if (!ct_x509_cert_fixup(pretmp, presigner))\n            goto err;\n        prederlen = i2d_re_X509_tbs(pretmp, &preder);\n        if (prederlen <= 0)\n            goto err;\n    }\n    X509_free(pretmp);\n    OPENSSL_free(sctx->certder);\n    sctx->certder = certder;\n    sctx->certderlen = certderlen;\n    OPENSSL_free(sctx->preder);\n    sctx->preder = preder;\n    sctx->prederlen = prederlen;\n    return 1;\nerr:\n    OPENSSL_free(certder);\n    OPENSSL_free(preder);\n    X509_free(pretmp);\n    return 0;\n}', 'IMPLEMENT_ASN1_FUNCTIONS(X509)', 'void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)\n{\n    asn1_item_embed_free(&val, it, 0);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}', 'int SCT_CTX_set1_issuer(SCT_CTX *sctx, const X509 *issuer)\n{\n    return ct_public_key_hash(X509_get_X509_PUBKEY(issuer), &sctx->ihash,\n                              &sctx->ihashlen);\n}']