ssl/statem/statem_dtls.c:1151: error: MEMORY_LEAK
  memory dynamically allocated by call to `dtls1_hm_fragment_new()` at line 1104, column 12 is not reachable after line 1151, column 5.
Showing all 80 steps of the trace


ssl/statem/statem_dtls.c:1092:1: start of procedure dtls1_buffer_message()
1090.   }
1091.   
1092. > int dtls1_buffer_message(SSL *s, int is_ccs)
1093.   {
1094.       pitem *item;

ssl/statem/statem_dtls.c:1102:5: Condition is true
1100.        * serialized
1101.        */
1102.       OPENSSL_assert(s->init_off == 0);
            ^
1103.   
1104.       frag = dtls1_hm_fragment_new(s->init_num, 0);

ssl/statem/statem_dtls.c:1104:5: 
1102.       OPENSSL_assert(s->init_off == 0);
1103.   
1104. >     frag = dtls1_hm_fragment_new(s->init_num, 0);
1105.       if (frag == NULL)
1106.           return 0;

ssl/statem/statem_dtls.c:163:1: start of procedure dtls1_hm_fragment_new()
  161.   static int dtls_get_reassembled_message(SSL *s, long *len);
  162.   
  163. > static hm_fragment *dtls1_hm_fragment_new(unsigned long frag_len,
  164.                                             int reassembly)
  165.   {

ssl/statem/statem_dtls.c:166:5: 
  164.                                             int reassembly)
  165.   {
  166. >     hm_fragment *frag = NULL;
  167.       unsigned char *buf = NULL;
  168.       unsigned char *bitmask = NULL;

ssl/statem/statem_dtls.c:167:5: 
  165.   {
  166.       hm_fragment *frag = NULL;
  167. >     unsigned char *buf = NULL;
  168.       unsigned char *bitmask = NULL;
  169.   

ssl/statem/statem_dtls.c:168:5: 
  166.       hm_fragment *frag = NULL;
  167.       unsigned char *buf = NULL;
  168. >     unsigned char *bitmask = NULL;
  169.   
  170.       frag = OPENSSL_malloc(sizeof(*frag));

ssl/statem/statem_dtls.c:170:5: 
  168.       unsigned char *bitmask = NULL;
  169.   
  170. >     frag = OPENSSL_malloc(sizeof(*frag));
  171.       if (frag == NULL)
  172.           return NULL;

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/statem/statem_dtls.c:171:9: Taking false branch
  169.   
  170.       frag = OPENSSL_malloc(sizeof(*frag));
  171.       if (frag == NULL)
                 ^
  172.           return NULL;
  173.   

ssl/statem/statem_dtls.c:174:9: Taking true branch
  172.           return NULL;
  173.   
  174.       if (frag_len) {
                 ^
  175.           buf = OPENSSL_malloc(frag_len);
  176.           if (buf == NULL) {

ssl/statem/statem_dtls.c:175:9: 
  173.   
  174.       if (frag_len) {
  175. >         buf = OPENSSL_malloc(frag_len);
  176.           if (buf == NULL) {
  177.               OPENSSL_free(frag);

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/statem/statem_dtls.c:176:13: Taking false branch
  174.       if (frag_len) {
  175.           buf = OPENSSL_malloc(frag_len);
  176.           if (buf == NULL) {
                     ^
  177.               OPENSSL_free(frag);
  178.               return NULL;

ssl/statem/statem_dtls.c:183:5: 
  181.   
  182.       /* zero length fragment gets zero frag->fragment */
  183. >     frag->fragment = buf;
  184.   
  185.       /* Initialize reassembly bitmask if necessary */

ssl/statem/statem_dtls.c:186:9: Taking false branch
  184.   
  185.       /* Initialize reassembly bitmask if necessary */
  186.       if (reassembly) {
                 ^
  187.           bitmask = OPENSSL_zalloc(RSMBLY_BITMASK_SIZE(frag_len));
  188.           if (bitmask == NULL) {

ssl/statem/statem_dtls.c:195:5: 
  193.       }
  194.   
  195. >     frag->reassembly = bitmask;
  196.   
  197.       return frag;

ssl/statem/statem_dtls.c:197:5: 
  195.       frag->reassembly = bitmask;
  196.   
  197. >     return frag;
  198.   }
  199.   

ssl/statem/statem_dtls.c:198:1: return from a call to dtls1_hm_fragment_new
  196.   
  197.       return frag;
  198. > }
  199.   
  200.   void dtls1_hm_fragment_free(hm_fragment *frag)

ssl/statem/statem_dtls.c:1105:9: Taking false branch
1103.   
1104.       frag = dtls1_hm_fragment_new(s->init_num, 0);
1105.       if (frag == NULL)
                ^
1106.           return 0;
1107.   

ssl/statem/statem_dtls.c:1108:5: 
1106.           return 0;
1107.   
1108. >     memcpy(frag->fragment, s->init_buf->data, s->init_num);
1109.   
1110.       if (is_ccs) {

ssl/statem/statem_dtls.c:1110:9: Taking true branch
1108.       memcpy(frag->fragment, s->init_buf->data, s->init_num);
1109.   
1110.       if (is_ccs) {
                ^
1111.           /* For DTLS1_BAD_VER the header length is non-standard */
1112.           OPENSSL_assert(s->d1->w_msg_hdr.msg_len +

ssl/statem/statem_dtls.c:1112:9: Condition is false
1110.       if (is_ccs) {
1111.           /* For DTLS1_BAD_VER the header length is non-standard */
1112.           OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
                ^
1113.                          ((s->version==DTLS1_BAD_VER)?3:DTLS1_CCS_HEADER_LENGTH)
1114.                          == (unsigned int)s->init_num);

ssl/statem/statem_dtls.c:1112:9: Condition is true
1110.       if (is_ccs) {
1111.           /* For DTLS1_BAD_VER the header length is non-standard */
1112.           OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
                ^
1113.                          ((s->version==DTLS1_BAD_VER)?3:DTLS1_CCS_HEADER_LENGTH)
1114.                          == (unsigned int)s->init_num);

ssl/statem/statem_dtls.c:1120:5: 
1118.       }
1119.   
1120. >     frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
1121.       frag->msg_header.seq = s->d1->w_msg_hdr.seq;
1122.       frag->msg_header.type = s->d1->w_msg_hdr.type;

ssl/statem/statem_dtls.c:1121:5: 
1119.   
1120.       frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
1121. >     frag->msg_header.seq = s->d1->w_msg_hdr.seq;
1122.       frag->msg_header.type = s->d1->w_msg_hdr.type;
1123.       frag->msg_header.frag_off = 0;

ssl/statem/statem_dtls.c:1122:5: 
1120.       frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
1121.       frag->msg_header.seq = s->d1->w_msg_hdr.seq;
1122. >     frag->msg_header.type = s->d1->w_msg_hdr.type;
1123.       frag->msg_header.frag_off = 0;
1124.       frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;

ssl/statem/statem_dtls.c:1123:5: 
1121.       frag->msg_header.seq = s->d1->w_msg_hdr.seq;
1122.       frag->msg_header.type = s->d1->w_msg_hdr.type;
1123. >     frag->msg_header.frag_off = 0;
1124.       frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
1125.       frag->msg_header.is_ccs = is_ccs;

ssl/statem/statem_dtls.c:1124:5: 
1122.       frag->msg_header.type = s->d1->w_msg_hdr.type;
1123.       frag->msg_header.frag_off = 0;
1124. >     frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
1125.       frag->msg_header.is_ccs = is_ccs;
1126.   

ssl/statem/statem_dtls.c:1125:5: 
1123.       frag->msg_header.frag_off = 0;
1124.       frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
1125. >     frag->msg_header.is_ccs = is_ccs;
1126.   
1127.       /* save current state */

ssl/statem/statem_dtls.c:1128:5: 
1126.   
1127.       /* save current state */
1128. >     frag->msg_header.saved_retransmit_state.enc_write_ctx = s->enc_write_ctx;
1129.       frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
1130.       frag->msg_header.saved_retransmit_state.compress = s->compress;

ssl/statem/statem_dtls.c:1129:5: 
1127.       /* save current state */
1128.       frag->msg_header.saved_retransmit_state.enc_write_ctx = s->enc_write_ctx;
1129. >     frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
1130.       frag->msg_header.saved_retransmit_state.compress = s->compress;
1131.       frag->msg_header.saved_retransmit_state.session = s->session;

ssl/statem/statem_dtls.c:1130:5: 
1128.       frag->msg_header.saved_retransmit_state.enc_write_ctx = s->enc_write_ctx;
1129.       frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
1130. >     frag->msg_header.saved_retransmit_state.compress = s->compress;
1131.       frag->msg_header.saved_retransmit_state.session = s->session;
1132.       frag->msg_header.saved_retransmit_state.epoch =

ssl/statem/statem_dtls.c:1131:5: 
1129.       frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
1130.       frag->msg_header.saved_retransmit_state.compress = s->compress;
1131. >     frag->msg_header.saved_retransmit_state.session = s->session;
1132.       frag->msg_header.saved_retransmit_state.epoch =
1133.           DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer);

ssl/statem/statem_dtls.c:1132:5: 
1130.       frag->msg_header.saved_retransmit_state.compress = s->compress;
1131.       frag->msg_header.saved_retransmit_state.session = s->session;
1132. >     frag->msg_header.saved_retransmit_state.epoch =
1133.           DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer);
1134.   

ssl/statem/statem_dtls.c:1135:5: 
1133.           DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer);
1134.   
1135. >     memset(seq64be, 0, sizeof(seq64be));
1136.       seq64be[6] =
1137.           (unsigned

ssl/statem/statem_dtls.c:1136:5: 
1134.   
1135.       memset(seq64be, 0, sizeof(seq64be));
1136. >     seq64be[6] =
1137.           (unsigned
1138.            char)(dtls1_get_queue_priority(frag->msg_header.seq,

ssl/statem/statem_dtls.c:1052:1: start of procedure dtls1_get_queue_priority()
  1050.   }
  1051.   
  1052. > int dtls1_get_queue_priority(unsigned short seq, int is_ccs)
  1053.   {
  1054.       /*

ssl/statem/statem_dtls.c:1064:5: 
  1062.        * priority queues) and fits in the unsigned short variable.
  1063.        */
  1064. >     return seq * 2 - is_ccs;
  1065.   }
  1066.   

ssl/statem/statem_dtls.c:1065:1: return from a call to dtls1_get_queue_priority
  1063.        */
  1064.       return seq * 2 - is_ccs;
  1065. > }
  1066.   
  1067.   int dtls1_retransmit_buffered_messages(SSL *s)

ssl/statem/statem_dtls.c:1140:5: 
1138.            char)(dtls1_get_queue_priority(frag->msg_header.seq,
1139.                                           frag->msg_header.is_ccs) >> 8);
1140. >     seq64be[7] =
1141.           (unsigned
1142.            char)(dtls1_get_queue_priority(frag->msg_header.seq,

ssl/statem/statem_dtls.c:1052:1: start of procedure dtls1_get_queue_priority()
  1050.   }
  1051.   
  1052. > int dtls1_get_queue_priority(unsigned short seq, int is_ccs)
  1053.   {
  1054.       /*

ssl/statem/statem_dtls.c:1064:5: 
  1062.        * priority queues) and fits in the unsigned short variable.
  1063.        */
  1064. >     return seq * 2 - is_ccs;
  1065.   }
  1066.   

ssl/statem/statem_dtls.c:1065:1: return from a call to dtls1_get_queue_priority
  1063.        */
  1064.       return seq * 2 - is_ccs;
  1065. > }
  1066.   
  1067.   int dtls1_retransmit_buffered_messages(SSL *s)

ssl/statem/statem_dtls.c:1145:5: 
1143.                                           frag->msg_header.is_ccs));
1144.   
1145. >     item = pitem_new(seq64be, frag);
1146.       if (item == NULL) {
1147.           dtls1_hm_fragment_free(frag);

crypto/pqueue/pqueue.c:69:1: start of procedure pitem_new()
  67.   } pqueue_s;
  68.   
  69. > pitem *pitem_new(unsigned char *prio64be, void *data)
  70.   {
  71.       pitem *item = OPENSSL_malloc(sizeof(*item));

crypto/pqueue/pqueue.c:71:5: 
  69.   pitem *pitem_new(unsigned char *prio64be, void *data)
  70.   {
  71. >     pitem *item = OPENSSL_malloc(sizeof(*item));
  72.       if (item == NULL)
  73.           return NULL;

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/pqueue/pqueue.c:72:9: Taking false branch
  70.   {
  71.       pitem *item = OPENSSL_malloc(sizeof(*item));
  72.       if (item == NULL)
                ^
  73.           return NULL;
  74.   

crypto/pqueue/pqueue.c:75:5: 
  73.           return NULL;
  74.   
  75. >     memcpy(item->priority, prio64be, sizeof(item->priority));
  76.   
  77.       item->data = data;

crypto/pqueue/pqueue.c:77:5: 
  75.       memcpy(item->priority, prio64be, sizeof(item->priority));
  76.   
  77. >     item->data = data;
  78.       item->next = NULL;
  79.   

crypto/pqueue/pqueue.c:78:5: 
  76.   
  77.       item->data = data;
  78. >     item->next = NULL;
  79.   
  80.       return item;

crypto/pqueue/pqueue.c:80:5: 
  78.       item->next = NULL;
  79.   
  80. >     return item;
  81.   }
  82.   

crypto/pqueue/pqueue.c:81:1: return from a call to pitem_new
  79.   
  80.       return item;
  81. > }
  82.   
  83.   void pitem_free(pitem *item)

ssl/statem/statem_dtls.c:1146:9: Taking false branch
1144.   
1145.       item = pitem_new(seq64be, frag);
1146.       if (item == NULL) {
                ^
1147.           dtls1_hm_fragment_free(frag);
1148.           return 0;

ssl/statem/statem_dtls.c:1151:5: Skipping pqueue_insert(): empty list of specs
1149.       }
1150.   
1151.       pqueue_insert(s->d1->sent_messages, item);
            ^
1152.       return 1;
1153.   }
