ssl/statem/statem_dtls.c:789: error: MEMORY_LEAK
  memory dynamically allocated by call to `dtls1_hm_fragment_new()` at line 767, column 16 is not reachable after line 789, column 16.
Showing all 87 steps of the trace


ssl/statem/statem_dtls.c:713:1: start of procedure dtls1_process_out_of_seq_message()
711.   }
712.   
713. > static int
714.   dtls1_process_out_of_seq_message(SSL *s, const struct hm_header_st *msg_hdr,
715.                                    int *ok)

ssl/statem/statem_dtls.c:717:5: 
715.                                    int *ok)
716.   {
717. >     int i = -1;
718.       hm_fragment *frag = NULL;
719.       pitem *item = NULL;

ssl/statem/statem_dtls.c:718:5: 
716.   {
717.       int i = -1;
718. >     hm_fragment *frag = NULL;
719.       pitem *item = NULL;
720.       unsigned char seq64be[8];

ssl/statem/statem_dtls.c:719:5: 
717.       int i = -1;
718.       hm_fragment *frag = NULL;
719. >     pitem *item = NULL;
720.       unsigned char seq64be[8];
721.       unsigned long frag_len = msg_hdr->frag_len;

ssl/statem/statem_dtls.c:721:5: 
719.       pitem *item = NULL;
720.       unsigned char seq64be[8];
721. >     unsigned long frag_len = msg_hdr->frag_len;
722.   
723.       if ((msg_hdr->frag_off + frag_len) > msg_hdr->msg_len)

ssl/statem/statem_dtls.c:723:9: Taking false branch
721.       unsigned long frag_len = msg_hdr->frag_len;
722.   
723.       if ((msg_hdr->frag_off + frag_len) > msg_hdr->msg_len)
               ^
724.           goto err;
725.   

ssl/statem/statem_dtls.c:727:5: 
725.   
726.       /* Try to find item in queue, to prevent duplicate entries */
727. >     memset(seq64be, 0, sizeof(seq64be));
728.       seq64be[6] = (unsigned char)(msg_hdr->seq >> 8);
729.       seq64be[7] = (unsigned char)msg_hdr->seq;

ssl/statem/statem_dtls.c:728:5: 
726.       /* Try to find item in queue, to prevent duplicate entries */
727.       memset(seq64be, 0, sizeof(seq64be));
728. >     seq64be[6] = (unsigned char)(msg_hdr->seq >> 8);
729.       seq64be[7] = (unsigned char)msg_hdr->seq;
730.       item = pqueue_find(s->d1->buffered_messages, seq64be);

ssl/statem/statem_dtls.c:729:5: 
727.       memset(seq64be, 0, sizeof(seq64be));
728.       seq64be[6] = (unsigned char)(msg_hdr->seq >> 8);
729. >     seq64be[7] = (unsigned char)msg_hdr->seq;
730.       item = pqueue_find(s->d1->buffered_messages, seq64be);
731.   

ssl/statem/statem_dtls.c:730:5: 
728.       seq64be[6] = (unsigned char)(msg_hdr->seq >> 8);
729.       seq64be[7] = (unsigned char)msg_hdr->seq;
730. >     item = pqueue_find(s->d1->buffered_messages, seq64be);
731.   
732.       /*

crypto/pqueue/pqueue.c:151:1: start of procedure pqueue_find()
  149.   }
  150.   
  151. > pitem *pqueue_find(pqueue_s *pq, unsigned char *prio64be)
  152.   {
  153.       pitem *next;

crypto/pqueue/pqueue.c:154:5: 
  152.   {
  153.       pitem *next;
  154. >     pitem *found = NULL;
  155.   
  156.       if (pq->items == NULL)

crypto/pqueue/pqueue.c:156:9: Taking true branch
  154.       pitem *found = NULL;
  155.   
  156.       if (pq->items == NULL)
                 ^
  157.           return NULL;
  158.   

crypto/pqueue/pqueue.c:157:9: 
  155.   
  156.       if (pq->items == NULL)
  157. >         return NULL;
  158.   
  159.       for (next = pq->items; next->next != NULL; next = next->next) {

crypto/pqueue/pqueue.c:174:1: return from a call to pqueue_find
  172.   
  173.       return found;
  174. > }
  175.   
  176.   void pqueue_print(pqueue_s *pq)

ssl/statem/statem_dtls.c:736:9: Taking false branch
734.        * it and rather try to reassemble it.
735.        */
736.       if (item != NULL && frag_len != msg_hdr->msg_len)
               ^
737.           item = NULL;
738.   

ssl/statem/statem_dtls.c:744:9: Taking false branch
742.        * before the SERVER_HELLO, which then must be a stale retransmit.
743.        */
744.       if (msg_hdr->seq <= s->d1->handshake_read_seq ||
               ^
745.           msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL ||
746.           (s->d1->handshake_read_seq == 0 && msg_hdr->type == SSL3_MT_FINISHED))

ssl/statem/statem_dtls.c:745:9: Taking false branch
743.        */
744.       if (msg_hdr->seq <= s->d1->handshake_read_seq ||
745.           msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL ||
               ^
746.           (s->d1->handshake_read_seq == 0 && msg_hdr->type == SSL3_MT_FINISHED))
747.       {

ssl/statem/statem_dtls.c:745:58: Taking false branch
743.        */
744.       if (msg_hdr->seq <= s->d1->handshake_read_seq ||
745.           msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL ||
                                                                ^
746.           (s->d1->handshake_read_seq == 0 && msg_hdr->type == SSL3_MT_FINISHED))
747.       {

ssl/statem/statem_dtls.c:746:10: Taking false branch
744.       if (msg_hdr->seq <= s->d1->handshake_read_seq ||
745.           msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL ||
746.           (s->d1->handshake_read_seq == 0 && msg_hdr->type == SSL3_MT_FINISHED))
                ^
747.       {
748.           unsigned char devnull[256];

ssl/statem/statem_dtls.c:761:13: Taking false branch
759.           }
760.       } else {
761.           if (frag_len != msg_hdr->msg_len)
                   ^
762.               return dtls1_reassemble_fragment(s, msg_hdr, ok);
763.   

ssl/statem/statem_dtls.c:764:13: 
762.               return dtls1_reassemble_fragment(s, msg_hdr, ok);
763.   
764. >         if (frag_len > dtls1_max_handshake_message_len(s))
765.               goto err;
766.   

ssl/statem/statem_dtls.c:599:1: start of procedure dtls1_max_handshake_message_len()
  597.    * may be greater if the maximum certificate list size requires it.
  598.    */
  599. > static unsigned long dtls1_max_handshake_message_len(const SSL *s)
  600.   {
  601.       unsigned long max_len =

ssl/statem/statem_dtls.c:601:5: 
  599.   static unsigned long dtls1_max_handshake_message_len(const SSL *s)
  600.   {
  601. >     unsigned long max_len =
  602.           DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
  603.       if (max_len < (unsigned long)s->max_cert_list)

ssl/statem/statem_dtls.c:603:9: Taking true branch
  601.       unsigned long max_len =
  602.           DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
  603.       if (max_len < (unsigned long)s->max_cert_list)
                 ^
  604.           return s->max_cert_list;
  605.       return max_len;

ssl/statem/statem_dtls.c:604:9: 
  602.           DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
  603.       if (max_len < (unsigned long)s->max_cert_list)
  604. >         return s->max_cert_list;
  605.       return max_len;
  606.   }

ssl/statem/statem_dtls.c:606:1: return from a call to dtls1_max_handshake_message_len
  604.           return s->max_cert_list;
  605.       return max_len;
  606. > }
  607.   
  608.   static int

ssl/statem/statem_dtls.c:764:13: Taking false branch
762.               return dtls1_reassemble_fragment(s, msg_hdr, ok);
763.   
764.           if (frag_len > dtls1_max_handshake_message_len(s))
                   ^
765.               goto err;
766.   

ssl/statem/statem_dtls.c:767:9: 
765.               goto err;
766.   
767. >         frag = dtls1_hm_fragment_new(frag_len, 0);
768.           if (frag == NULL)
769.               goto err;

ssl/statem/statem_dtls.c:163:1: start of procedure dtls1_hm_fragment_new()
  161.   static int dtls_get_reassembled_message(SSL *s, long *len);
  162.   
  163. > static hm_fragment *dtls1_hm_fragment_new(unsigned long frag_len,
  164.                                             int reassembly)
  165.   {

ssl/statem/statem_dtls.c:166:5: 
  164.                                             int reassembly)
  165.   {
  166. >     hm_fragment *frag = NULL;
  167.       unsigned char *buf = NULL;
  168.       unsigned char *bitmask = NULL;

ssl/statem/statem_dtls.c:167:5: 
  165.   {
  166.       hm_fragment *frag = NULL;
  167. >     unsigned char *buf = NULL;
  168.       unsigned char *bitmask = NULL;
  169.   

ssl/statem/statem_dtls.c:168:5: 
  166.       hm_fragment *frag = NULL;
  167.       unsigned char *buf = NULL;
  168. >     unsigned char *bitmask = NULL;
  169.   
  170.       frag = OPENSSL_malloc(sizeof(*frag));

ssl/statem/statem_dtls.c:170:5: 
  168.       unsigned char *bitmask = NULL;
  169.   
  170. >     frag = OPENSSL_malloc(sizeof(*frag));
  171.       if (frag == NULL)
  172.           return NULL;

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/statem/statem_dtls.c:171:9: Taking false branch
  169.   
  170.       frag = OPENSSL_malloc(sizeof(*frag));
  171.       if (frag == NULL)
                 ^
  172.           return NULL;
  173.   

ssl/statem/statem_dtls.c:174:9: Taking true branch
  172.           return NULL;
  173.   
  174.       if (frag_len) {
                 ^
  175.           buf = OPENSSL_malloc(frag_len);
  176.           if (buf == NULL) {

ssl/statem/statem_dtls.c:175:9: 
  173.   
  174.       if (frag_len) {
  175. >         buf = OPENSSL_malloc(frag_len);
  176.           if (buf == NULL) {
  177.               OPENSSL_free(frag);

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/statem/statem_dtls.c:176:13: Taking false branch
  174.       if (frag_len) {
  175.           buf = OPENSSL_malloc(frag_len);
  176.           if (buf == NULL) {
                     ^
  177.               OPENSSL_free(frag);
  178.               return NULL;

ssl/statem/statem_dtls.c:183:5: 
  181.   
  182.       /* zero length fragment gets zero frag->fragment */
  183. >     frag->fragment = buf;
  184.   
  185.       /* Initialize reassembly bitmask if necessary */

ssl/statem/statem_dtls.c:186:9: Taking false branch
  184.   
  185.       /* Initialize reassembly bitmask if necessary */
  186.       if (reassembly) {
                 ^
  187.           bitmask = OPENSSL_zalloc(RSMBLY_BITMASK_SIZE(frag_len));
  188.           if (bitmask == NULL) {

ssl/statem/statem_dtls.c:195:5: 
  193.       }
  194.   
  195. >     frag->reassembly = bitmask;
  196.   
  197.       return frag;

ssl/statem/statem_dtls.c:197:5: 
  195.       frag->reassembly = bitmask;
  196.   
  197. >     return frag;
  198.   }
  199.   

ssl/statem/statem_dtls.c:198:1: return from a call to dtls1_hm_fragment_new
  196.   
  197.       return frag;
  198. > }
  199.   
  200.   void dtls1_hm_fragment_free(hm_fragment *frag)

ssl/statem/statem_dtls.c:768:13: Taking false branch
766.   
767.           frag = dtls1_hm_fragment_new(frag_len, 0);
768.           if (frag == NULL)
                   ^
769.               goto err;
770.   

ssl/statem/statem_dtls.c:771:9: 
769.               goto err;
770.   
771. >         memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
772.   
773.           if (frag_len) {

ssl/statem/statem_dtls.c:773:13: Taking true branch
771.           memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
772.   
773.           if (frag_len) {
                   ^
774.               /*
775.                * read the body of the fragment (header has already been read

ssl/statem/statem_dtls.c:777:13: Skipping __function_pointer__(): unresolved function pointer
775.                * read the body of the fragment (header has already been read
776.                */
777.               i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL,
                   ^
778.                                             frag->fragment, frag_len, 0);
779.               if ((unsigned long)i != frag_len)

ssl/statem/statem_dtls.c:779:17: Taking false branch
777.               i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL,
778.                                             frag->fragment, frag_len, 0);
779.               if ((unsigned long)i != frag_len)
                       ^
780.                   i = -1;
781.               if (i <= 0)

ssl/statem/statem_dtls.c:781:17: Taking false branch
779.               if ((unsigned long)i != frag_len)
780.                   i = -1;
781.               if (i <= 0)
                       ^
782.                   goto err;
783.           }

ssl/statem/statem_dtls.c:785:9: 
783.           }
784.   
785. >         item = pitem_new(seq64be, frag);
786.           if (item == NULL)
787.               goto err;

crypto/pqueue/pqueue.c:69:1: start of procedure pitem_new()
  67.   } pqueue_s;
  68.   
  69. > pitem *pitem_new(unsigned char *prio64be, void *data)
  70.   {
  71.       pitem *item = OPENSSL_malloc(sizeof(*item));

crypto/pqueue/pqueue.c:71:5: 
  69.   pitem *pitem_new(unsigned char *prio64be, void *data)
  70.   {
  71. >     pitem *item = OPENSSL_malloc(sizeof(*item));
  72.       if (item == NULL)
  73.           return NULL;

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/pqueue/pqueue.c:72:9: Taking false branch
  70.   {
  71.       pitem *item = OPENSSL_malloc(sizeof(*item));
  72.       if (item == NULL)
                ^
  73.           return NULL;
  74.   

crypto/pqueue/pqueue.c:75:5: 
  73.           return NULL;
  74.   
  75. >     memcpy(item->priority, prio64be, sizeof(item->priority));
  76.   
  77.       item->data = data;

crypto/pqueue/pqueue.c:77:5: 
  75.       memcpy(item->priority, prio64be, sizeof(item->priority));
  76.   
  77. >     item->data = data;
  78.       item->next = NULL;
  79.   

crypto/pqueue/pqueue.c:78:5: 
  76.   
  77.       item->data = data;
  78. >     item->next = NULL;
  79.   
  80.       return item;

crypto/pqueue/pqueue.c:80:5: 
  78.       item->next = NULL;
  79.   
  80. >     return item;
  81.   }
  82.   

crypto/pqueue/pqueue.c:81:1: return from a call to pitem_new
  79.   
  80.       return item;
  81. > }
  82.   
  83.   void pitem_free(pitem *item)

ssl/statem/statem_dtls.c:786:13: Taking false branch
784.   
785.           item = pitem_new(seq64be, frag);
786.           if (item == NULL)
                   ^
787.               goto err;
788.   

ssl/statem/statem_dtls.c:789:9: Skipping pqueue_insert(): empty list of specs
787.               goto err;
788.   
789.           item = pqueue_insert(s->d1->buffered_messages, item);
               ^
790.           /*
791.            * pqueue_insert fails iff a duplicate item is inserted. However,
