ssl/record/rec_layer_d1.c:315: error: MEMORY_LEAK
  memory dynamically allocated to `return` by call to `pitem_new()` at line 268, column 12 is not reachable after line 315, column 5.
Showing all 54 steps of the trace


ssl/record/rec_layer_d1.c:258:1: start of procedure dtls1_buffer_record()
256.   }
257.   
258. > int dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
259.   {
260.       DTLS1_RECORD_DATA *rdata;

ssl/record/rec_layer_d1.c:264:9: 
262.   
263.       /* Limit the size of the queue to prevent DOS attacks */
264. >     if (pqueue_size(queue->q) >= 100)
265.           return 0;
266.   

crypto/pqueue/pqueue.c:209:1: start of procedure pqueue_size()
  207.   }
  208.   
  209. > int pqueue_size(pqueue_s *pq)
  210.   {
  211.       pitem *item = pq->items;

crypto/pqueue/pqueue.c:211:5: 
  209.   int pqueue_size(pqueue_s *pq)
  210.   {
  211. >     pitem *item = pq->items;
  212.       int count = 0;
  213.   

crypto/pqueue/pqueue.c:212:5: 
  210.   {
  211.       pitem *item = pq->items;
  212. >     int count = 0;
  213.   
  214.       while (item != NULL) {

crypto/pqueue/pqueue.c:214:12: Loop condition is true. Entering loop body
  212.       int count = 0;
  213.   
  214.       while (item != NULL) {
                    ^
  215.           count++;
  216.           item = item->next;

crypto/pqueue/pqueue.c:215:9: 
  213.   
  214.       while (item != NULL) {
  215. >         count++;
  216.           item = item->next;
  217.       }

crypto/pqueue/pqueue.c:216:9: 
  214.       while (item != NULL) {
  215.           count++;
  216. >         item = item->next;
  217.       }
  218.       return count;

crypto/pqueue/pqueue.c:214:12: Loop condition is false. Leaving loop
  212.       int count = 0;
  213.   
  214.       while (item != NULL) {
                    ^
  215.           count++;
  216.           item = item->next;

crypto/pqueue/pqueue.c:218:5: 
  216.           item = item->next;
  217.       }
  218. >     return count;
  219.   }

crypto/pqueue/pqueue.c:219:1: return from a call to pqueue_size
  217.       }
  218.       return count;
  219. > }

ssl/record/rec_layer_d1.c:264:9: Taking false branch
262.   
263.       /* Limit the size of the queue to prevent DOS attacks */
264.       if (pqueue_size(queue->q) >= 100)
               ^
265.           return 0;
266.   

ssl/record/rec_layer_d1.c:267:5: 
265.           return 0;
266.   
267. >     rdata = OPENSSL_malloc(sizeof(*rdata));
268.       item = pitem_new(priority, rdata);
269.       if (rdata == NULL || item == NULL) {

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
  118.   }
  119.   
  120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
  121.   {
  122.       void *ret = NULL;

crypto/mem.c:122:5: 
  120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
  121.   {
  122. >     void *ret = NULL;
  123.   
  124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
  122.       void *ret = NULL;
  123.   
  124.       if (num <= 0)
                 ^
  125.           return NULL;
  126.   

crypto/mem.c:127:5: 
  125.           return NULL;
  126.   
  127. >     allow_customize = 0;
  128.   #ifdef CRYPTO_MDEBUG
  129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
  135.       }
  136.   #else
  137. >     (void)file;
  138.       (void)line;
  139.       ret = malloc(num);

crypto/mem.c:138:5: 
  136.   #else
  137.       (void)file;
  138. >     (void)line;
  139.       ret = malloc(num);
  140.   #endif

crypto/mem.c:139:5: 
  137.       (void)file;
  138.       (void)line;
  139. >     ret = malloc(num);
  140.   #endif
  141.   

crypto/mem.c:154:5: 
  152.   #endif
  153.   
  154. >     return ret;
  155.   }
  156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
  153.   
  154.       return ret;
  155. > }
  156.   
  157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/record/rec_layer_d1.c:268:5: 
266.   
267.       rdata = OPENSSL_malloc(sizeof(*rdata));
268. >     item = pitem_new(priority, rdata);
269.       if (rdata == NULL || item == NULL) {
270.           OPENSSL_free(rdata);

crypto/pqueue/pqueue.c:69:1: start of procedure pitem_new()
  67.   } pqueue_s;
  68.   
  69. > pitem *pitem_new(unsigned char *prio64be, void *data)
  70.   {
  71.       pitem *item = OPENSSL_malloc(sizeof(*item));

crypto/pqueue/pqueue.c:71:5: 
  69.   pitem *pitem_new(unsigned char *prio64be, void *data)
  70.   {
  71. >     pitem *item = OPENSSL_malloc(sizeof(*item));
  72.       if (item == NULL)
  73.           return NULL;

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifdef CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/pqueue/pqueue.c:72:9: Taking false branch
  70.   {
  71.       pitem *item = OPENSSL_malloc(sizeof(*item));
  72.       if (item == NULL)
                ^
  73.           return NULL;
  74.   

crypto/pqueue/pqueue.c:75:5: 
  73.           return NULL;
  74.   
  75. >     memcpy(item->priority, prio64be, sizeof(item->priority));
  76.   
  77.       item->data = data;

crypto/pqueue/pqueue.c:77:5: 
  75.       memcpy(item->priority, prio64be, sizeof(item->priority));
  76.   
  77. >     item->data = data;
  78.       item->next = NULL;
  79.   

crypto/pqueue/pqueue.c:78:5: 
  76.   
  77.       item->data = data;
  78. >     item->next = NULL;
  79.   
  80.       return item;

crypto/pqueue/pqueue.c:80:5: 
  78.       item->next = NULL;
  79.   
  80. >     return item;
  81.   }
  82.   

crypto/pqueue/pqueue.c:81:1: return from a call to pitem_new
  79.   
  80.       return item;
  81. > }
  82.   
  83.   void pitem_free(pitem *item)

ssl/record/rec_layer_d1.c:269:9: Taking false branch
267.       rdata = OPENSSL_malloc(sizeof(*rdata));
268.       item = pitem_new(priority, rdata);
269.       if (rdata == NULL || item == NULL) {
               ^
270.           OPENSSL_free(rdata);
271.           pitem_free(item);

ssl/record/rec_layer_d1.c:269:26: Taking false branch
267.       rdata = OPENSSL_malloc(sizeof(*rdata));
268.       item = pitem_new(priority, rdata);
269.       if (rdata == NULL || item == NULL) {
                                ^
270.           OPENSSL_free(rdata);
271.           pitem_free(item);

ssl/record/rec_layer_d1.c:276:5: 
274.       }
275.   
276. >     rdata->packet = s->rlayer.packet;
277.       rdata->packet_length = s->rlayer.packet_length;
278.       memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));

ssl/record/rec_layer_d1.c:277:5: 
275.   
276.       rdata->packet = s->rlayer.packet;
277. >     rdata->packet_length = s->rlayer.packet_length;
278.       memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
279.       memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));

ssl/record/rec_layer_d1.c:278:5: 
276.       rdata->packet = s->rlayer.packet;
277.       rdata->packet_length = s->rlayer.packet_length;
278. >     memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
279.       memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
280.   

ssl/record/rec_layer_d1.c:279:5: 
277.       rdata->packet_length = s->rlayer.packet_length;
278.       memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
279. >     memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
280.   
281.       item->data = rdata;

ssl/record/rec_layer_d1.c:281:5: 
279.       memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
280.   
281. >     item->data = rdata;
282.   
283.   #ifndef OPENSSL_NO_SCTP

ssl/record/rec_layer_d1.c:293:5: 
291.   #endif
292.   
293. >     s->rlayer.packet = NULL;
294.       s->rlayer.packet_length = 0;
295.       memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));

ssl/record/rec_layer_d1.c:294:5: 
292.   
293.       s->rlayer.packet = NULL;
294. >     s->rlayer.packet_length = 0;
295.       memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
296.       memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));

ssl/record/rec_layer_d1.c:295:5: 
293.       s->rlayer.packet = NULL;
294.       s->rlayer.packet_length = 0;
295. >     memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
296.       memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
297.   

ssl/record/rec_layer_d1.c:296:5: 
294.       s->rlayer.packet_length = 0;
295.       memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
296. >     memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
297.   
298.       if (!ssl3_setup_buffers(s)) {

ssl/record/rec_layer_d1.c:298:10: Taking false branch
296.       memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
297.   
298.       if (!ssl3_setup_buffers(s)) {
                ^
299.           SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
300.           OPENSSL_free(rdata->rbuf.buf);

ssl/record/rec_layer_d1.c:307:9: Taking false branch
305.   
306.       /* insert should not fail, since duplicates are dropped */
307.       if (pqueue_insert(queue->q, item) == NULL) {
               ^
308.           SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
309.           OPENSSL_free(rdata->rbuf.buf);

ssl/record/rec_layer_d1.c:315:5: 
313.       }
314.   
315. >     return (1);
316.   }
317.   
