crypto/cms/cms_pwri.c:342: error: MEMORY_LEAK
  memory dynamically allocated to `kekctx` by call to `EVP_CIPHER_CTX_new()` at line 334, column 14 is not reachable after line 342, column 10.
Showing all 28 steps of the trace


crypto/cms/cms_pwri.c:319:1: start of procedure cms_RecipientInfo_pwri_crypt()
317.   /* Encrypt/Decrypt content key in PWRI recipient info */
318.   
319. > int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
320.                                    int en_de)
321.   {

crypto/cms/cms_pwri.c:324:5: 
322.       CMS_EncryptedContentInfo *ec;
323.       CMS_PasswordRecipientInfo *pwri;
324. >     int r = 0;
325.       X509_ALGOR *algtmp, *kekalg = NULL;
326.       EVP_CIPHER_CTX *kekctx;

crypto/cms/cms_pwri.c:325:5: 
323.       CMS_PasswordRecipientInfo *pwri;
324.       int r = 0;
325. >     X509_ALGOR *algtmp, *kekalg = NULL;
326.       EVP_CIPHER_CTX *kekctx;
327.       const EVP_CIPHER *kekcipher;

crypto/cms/cms_pwri.c:328:5: 
326.       EVP_CIPHER_CTX *kekctx;
327.       const EVP_CIPHER *kekcipher;
328. >     unsigned char *key = NULL;
329.       size_t keylen;
330.   

crypto/cms/cms_pwri.c:331:5: 
329.       size_t keylen;
330.   
331. >     ec = cms->d.envelopedData->encryptedContentInfo;
332.   
333.       pwri = ri->d.pwri;

crypto/cms/cms_pwri.c:333:5: 
331.       ec = cms->d.envelopedData->encryptedContentInfo;
332.   
333. >     pwri = ri->d.pwri;
334.       kekctx = EVP_CIPHER_CTX_new();
335.   

crypto/cms/cms_pwri.c:334:5: 
332.   
333.       pwri = ri->d.pwri;
334. >     kekctx = EVP_CIPHER_CTX_new();
335.   
336.       if (!pwri->pass) {

crypto/evp/evp_enc.c:93:1: start of procedure EVP_CIPHER_CTX_new()
  91.   }
  92.   
  93. > EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void)
  94.   {
  95.       return OPENSSL_zalloc(sizeof(EVP_CIPHER_CTX));

crypto/evp/evp_enc.c:95:5: 
  93.   EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void)
  94.   {
  95. >     return OPENSSL_zalloc(sizeof(EVP_CIPHER_CTX));
  96.   }
  97.   

crypto/mem.c:156:1: start of procedure CRYPTO_zalloc()
    154.   }
    155.   
    156. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:158:5: 
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158. >     void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (num <= 0)
                     ^
      124.           return NULL;
      125.   

crypto/mem.c:126:5: 
      124.           return NULL;
      125.   
      126. >     allow_customize = 0;
      127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
      134.       }
      135.   #else
      136. >     (void)file;
      137.       (void)line;
      138.       ret = malloc(num);

crypto/mem.c:137:5: 
      135.   #else
      136.       (void)file;
      137. >     (void)line;
      138.       ret = malloc(num);
      139.   #endif

crypto/mem.c:138:5: 
      136.       (void)file;
      137.       (void)line;
      138. >     ret = malloc(num);
      139.   #endif
      140.   

crypto/mem.c:153:5: 
      151.   #endif
      152.   
      153. >     return ret;
      154.   }
      155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
      152.   
      153.       return ret;
      154. > }
      155.   
      156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:160:9: Taking true branch
    158.       void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)
                   ^
    161.           memset(ret, 0, num);
    162.       return ret;

crypto/mem.c:161:9: 
    159.   
    160.       if (ret != NULL)
    161. >         memset(ret, 0, num);
    162.       return ret;
    163.   }

crypto/mem.c:162:5: 
    160.       if (ret != NULL)
    161.           memset(ret, 0, num);
    162. >     return ret;
    163.   }
    164.   

crypto/mem.c:163:1: return from a call to CRYPTO_zalloc
    161.           memset(ret, 0, num);
    162.       return ret;
    163. > }
    164.   
    165.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/evp_enc.c:96:1: return from a call to EVP_CIPHER_CTX_new
  94.   {
  95.       return OPENSSL_zalloc(sizeof(EVP_CIPHER_CTX));
  96. > }
  97.   
  98.   void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:336:10: Taking false branch
334.       kekctx = EVP_CIPHER_CTX_new();
335.   
336.       if (!pwri->pass) {
                ^
337.           CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_NO_PASSWORD);
338.           return 0;

crypto/cms/cms_pwri.c:340:5: 
338.           return 0;
339.       }
340. >     algtmp = pwri->keyEncryptionAlgorithm;
341.   
342.       if (!algtmp || OBJ_obj2nid(algtmp->algorithm) != NID_id_alg_PWRI_KEK) {

crypto/cms/cms_pwri.c:342:10: Taking true branch
340.       algtmp = pwri->keyEncryptionAlgorithm;
341.   
342.       if (!algtmp || OBJ_obj2nid(algtmp->algorithm) != NID_id_alg_PWRI_KEK) {
                ^
343.           CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
344.                  CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);

int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
                                 int en_de)
{
    CMS_EncryptedContentInfo *ec;
    CMS_PasswordRecipientInfo *pwri;
    int r = 0;
    X509_ALGOR *algtmp, *kekalg = NULL;
    EVP_CIPHER_CTX *kekctx;
    const EVP_CIPHER *kekcipher;
    unsigned char *key = NULL;
    size_t keylen;
    ec = cms->d.envelopedData->encryptedContentInfo;
    pwri = ri->d.pwri;
    kekctx = EVP_CIPHER_CTX_new();
    if (!pwri->pass) {
        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_NO_PASSWORD);
        return 0;
    }
    algtmp = pwri->keyEncryptionAlgorithm;
    if (!algtmp || OBJ_obj2nid(algtmp->algorithm) != NID_id_alg_PWRI_KEK) {
        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
               CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);
        return 0;
    }
    kekalg = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(X509_ALGOR),
                                       algtmp->parameter);
    if (kekalg == NULL) {
        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
               CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER);
        return 0;
    }
    kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);
    if (!kekcipher) {
        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_UNKNOWN_CIPHER);
        goto err;
    }
    if (!EVP_CipherInit_ex(kekctx, kekcipher, NULL, NULL, NULL, en_de))
        goto err;
    EVP_CIPHER_CTX_set_padding(kekctx, 0);
    if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) < 0) {
        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
               CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
        goto err;
    }
    algtmp = pwri->keyDerivationAlgorithm;
    if (EVP_PBE_CipherInit(algtmp->algorithm,
                           (char *)pwri->pass, pwri->passlen,
                           algtmp->parameter, kekctx, en_de) < 0) {
        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, ERR_R_EVP_LIB);
        goto err;
    }
    if (en_de) {
        if (!kek_wrap_key(NULL, &keylen, ec->key, ec->keylen, kekctx))
            goto err;
        key = OPENSSL_malloc(keylen);
        if (key == NULL)
            goto err;
        if (!kek_wrap_key(key, &keylen, ec->key, ec->keylen, kekctx))
            goto err;
        pwri->encryptedKey->data = key;
        pwri->encryptedKey->length = keylen;
    } else {
        key = OPENSSL_malloc(pwri->encryptedKey->length);
        if (key == NULL) {
            CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, ERR_R_MALLOC_FAILURE);
            goto err;
        }
        if (!kek_unwrap_key(key, &keylen,
                            pwri->encryptedKey->data,
                            pwri->encryptedKey->length, kekctx)) {
            CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_UNWRAP_FAILURE);
            goto err;
        }
        ec->key = key;
        ec->keylen = keylen;
    }
    r = 1;
 err:
    EVP_CIPHER_CTX_free(kekctx);
    if (!r)
        OPENSSL_free(key);
    X509_ALGOR_free(kekalg);
    return r;
}
['int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,\n                                 int en_de)\n{\n    CMS_EncryptedContentInfo *ec;\n    CMS_PasswordRecipientInfo *pwri;\n    int r = 0;\n    X509_ALGOR *algtmp, *kekalg = NULL;\n    EVP_CIPHER_CTX *kekctx;\n    const EVP_CIPHER *kekcipher;\n    unsigned char *key = NULL;\n    size_t keylen;\n    ec = cms->d.envelopedData->encryptedContentInfo;\n    pwri = ri->d.pwri;\n    kekctx = EVP_CIPHER_CTX_new();\n    if (!pwri->pass) {\n        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_NO_PASSWORD);\n        return 0;\n    }\n    algtmp = pwri->keyEncryptionAlgorithm;\n    if (!algtmp || OBJ_obj2nid(algtmp->algorithm) != NID_id_alg_PWRI_KEK) {\n        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,\n               CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);\n        return 0;\n    }\n    kekalg = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(X509_ALGOR),\n                                       algtmp->parameter);\n    if (kekalg == NULL) {\n        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,\n               CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER);\n        return 0;\n    }\n    kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);\n    if (!kekcipher) {\n        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_UNKNOWN_CIPHER);\n        goto err;\n    }\n    if (!EVP_CipherInit_ex(kekctx, kekcipher, NULL, NULL, NULL, en_de))\n        goto err;\n    EVP_CIPHER_CTX_set_padding(kekctx, 0);\n    if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) < 0) {\n        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,\n               CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);\n        goto err;\n    }\n    algtmp = pwri->keyDerivationAlgorithm;\n    if (EVP_PBE_CipherInit(algtmp->algorithm,\n                           (char *)pwri->pass, pwri->passlen,\n                           algtmp->parameter, kekctx, en_de) < 0) {\n        CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, ERR_R_EVP_LIB);\n        goto err;\n    }\n    if (en_de) {\n        if (!kek_wrap_key(NULL, &keylen, ec->key, ec->keylen, kekctx))\n            goto err;\n        key = OPENSSL_malloc(keylen);\n        if (key == NULL)\n            goto err;\n        if (!kek_wrap_key(key, &keylen, ec->key, ec->keylen, kekctx))\n            goto err;\n        pwri->encryptedKey->data = key;\n        pwri->encryptedKey->length = keylen;\n    } else {\n        key = OPENSSL_malloc(pwri->encryptedKey->length);\n        if (key == NULL) {\n            CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (!kek_unwrap_key(key, &keylen,\n                            pwri->encryptedKey->data,\n                            pwri->encryptedKey->length, kekctx)) {\n            CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_UNWRAP_FAILURE);\n            goto err;\n        }\n        ec->key = key;\n        ec->keylen = keylen;\n    }\n    r = 1;\n err:\n    EVP_CIPHER_CTX_free(kekctx);\n    if (!r)\n        OPENSSL_free(key);\n    X509_ALGOR_free(kekalg);\n    return r;\n}', 'EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void)\n{\n    return OPENSSL_zalloc(sizeof(EVP_CIPHER_CTX));\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']