ssl/statem/statem_dtls.c:1150: error: MEMORY_LEAK
  memory dynamically allocated by call to `dtls1_hm_fragment_new()` at line 1103, column 12 is not reachable after line 1150, column 5.
Showing all 80 steps of the trace


ssl/statem/statem_dtls.c:1091:1: start of procedure dtls1_buffer_message()
1089.   }
1090.   
1091. > int dtls1_buffer_message(SSL *s, int is_ccs)
1092.   {
1093.       pitem *item;

ssl/statem/statem_dtls.c:1101:5: Condition is true
1099.        * serialized
1100.        */
1101.       OPENSSL_assert(s->init_off == 0);
            ^
1102.   
1103.       frag = dtls1_hm_fragment_new(s->init_num, 0);

ssl/statem/statem_dtls.c:1103:5: 
1101.       OPENSSL_assert(s->init_off == 0);
1102.   
1103. >     frag = dtls1_hm_fragment_new(s->init_num, 0);
1104.       if (frag == NULL)
1105.           return 0;

ssl/statem/statem_dtls.c:162:1: start of procedure dtls1_hm_fragment_new()
  160.   static int dtls_get_reassembled_message(SSL *s, long *len);
  161.   
  162. > static hm_fragment *dtls1_hm_fragment_new(unsigned long frag_len,
  163.                                             int reassembly)
  164.   {

ssl/statem/statem_dtls.c:165:5: 
  163.                                             int reassembly)
  164.   {
  165. >     hm_fragment *frag = NULL;
  166.       unsigned char *buf = NULL;
  167.       unsigned char *bitmask = NULL;

ssl/statem/statem_dtls.c:166:5: 
  164.   {
  165.       hm_fragment *frag = NULL;
  166. >     unsigned char *buf = NULL;
  167.       unsigned char *bitmask = NULL;
  168.   

ssl/statem/statem_dtls.c:167:5: 
  165.       hm_fragment *frag = NULL;
  166.       unsigned char *buf = NULL;
  167. >     unsigned char *bitmask = NULL;
  168.   
  169.       frag = OPENSSL_malloc(sizeof(*frag));

ssl/statem/statem_dtls.c:169:5: 
  167.       unsigned char *bitmask = NULL;
  168.   
  169. >     frag = OPENSSL_malloc(sizeof(*frag));
  170.       if (frag == NULL)
  171.           return NULL;

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
    117.   }
    118.   
    119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121.       void *ret = NULL;

crypto/mem.c:121:5: 
    119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121. >     void *ret = NULL;
    122.   
    123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
    121.       void *ret = NULL;
    122.   
    123.       if (num <= 0)
                   ^
    124.           return NULL;
    125.   

crypto/mem.c:126:5: 
    124.           return NULL;
    125.   
    126. >     allow_customize = 0;
    127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
    134.       }
    135.   #else
    136. >     (void)file;
    137.       (void)line;
    138.       ret = malloc(num);

crypto/mem.c:137:5: 
    135.   #else
    136.       (void)file;
    137. >     (void)line;
    138.       ret = malloc(num);
    139.   #endif

crypto/mem.c:138:5: 
    136.       (void)file;
    137.       (void)line;
    138. >     ret = malloc(num);
    139.   #endif
    140.   

crypto/mem.c:153:5: 
    151.   #endif
    152.   
    153. >     return ret;
    154.   }
    155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
    152.   
    153.       return ret;
    154. > }
    155.   
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/statem/statem_dtls.c:170:9: Taking false branch
  168.   
  169.       frag = OPENSSL_malloc(sizeof(*frag));
  170.       if (frag == NULL)
                 ^
  171.           return NULL;
  172.   

ssl/statem/statem_dtls.c:173:9: Taking true branch
  171.           return NULL;
  172.   
  173.       if (frag_len) {
                 ^
  174.           buf = OPENSSL_malloc(frag_len);
  175.           if (buf == NULL) {

ssl/statem/statem_dtls.c:174:9: 
  172.   
  173.       if (frag_len) {
  174. >         buf = OPENSSL_malloc(frag_len);
  175.           if (buf == NULL) {
  176.               OPENSSL_free(frag);

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
    117.   }
    118.   
    119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121.       void *ret = NULL;

crypto/mem.c:121:5: 
    119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121. >     void *ret = NULL;
    122.   
    123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
    121.       void *ret = NULL;
    122.   
    123.       if (num <= 0)
                   ^
    124.           return NULL;
    125.   

crypto/mem.c:126:5: 
    124.           return NULL;
    125.   
    126. >     allow_customize = 0;
    127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
    134.       }
    135.   #else
    136. >     (void)file;
    137.       (void)line;
    138.       ret = malloc(num);

crypto/mem.c:137:5: 
    135.   #else
    136.       (void)file;
    137. >     (void)line;
    138.       ret = malloc(num);
    139.   #endif

crypto/mem.c:138:5: 
    136.       (void)file;
    137.       (void)line;
    138. >     ret = malloc(num);
    139.   #endif
    140.   

crypto/mem.c:153:5: 
    151.   #endif
    152.   
    153. >     return ret;
    154.   }
    155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
    152.   
    153.       return ret;
    154. > }
    155.   
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/statem/statem_dtls.c:175:13: Taking false branch
  173.       if (frag_len) {
  174.           buf = OPENSSL_malloc(frag_len);
  175.           if (buf == NULL) {
                     ^
  176.               OPENSSL_free(frag);
  177.               return NULL;

ssl/statem/statem_dtls.c:182:5: 
  180.   
  181.       /* zero length fragment gets zero frag->fragment */
  182. >     frag->fragment = buf;
  183.   
  184.       /* Initialize reassembly bitmask if necessary */

ssl/statem/statem_dtls.c:185:9: Taking false branch
  183.   
  184.       /* Initialize reassembly bitmask if necessary */
  185.       if (reassembly) {
                 ^
  186.           bitmask = OPENSSL_zalloc(RSMBLY_BITMASK_SIZE(frag_len));
  187.           if (bitmask == NULL) {

ssl/statem/statem_dtls.c:194:5: 
  192.       }
  193.   
  194. >     frag->reassembly = bitmask;
  195.   
  196.       return frag;

ssl/statem/statem_dtls.c:196:5: 
  194.       frag->reassembly = bitmask;
  195.   
  196. >     return frag;
  197.   }
  198.   

ssl/statem/statem_dtls.c:197:1: return from a call to dtls1_hm_fragment_new
  195.   
  196.       return frag;
  197. > }
  198.   
  199.   void dtls1_hm_fragment_free(hm_fragment *frag)

ssl/statem/statem_dtls.c:1104:9: Taking false branch
1102.   
1103.       frag = dtls1_hm_fragment_new(s->init_num, 0);
1104.       if (frag == NULL)
                ^
1105.           return 0;
1106.   

ssl/statem/statem_dtls.c:1107:5: 
1105.           return 0;
1106.   
1107. >     memcpy(frag->fragment, s->init_buf->data, s->init_num);
1108.   
1109.       if (is_ccs) {

ssl/statem/statem_dtls.c:1109:9: Taking true branch
1107.       memcpy(frag->fragment, s->init_buf->data, s->init_num);
1108.   
1109.       if (is_ccs) {
                ^
1110.           /* For DTLS1_BAD_VER the header length is non-standard */
1111.           OPENSSL_assert(s->d1->w_msg_hdr.msg_len +

ssl/statem/statem_dtls.c:1111:9: Condition is false
1109.       if (is_ccs) {
1110.           /* For DTLS1_BAD_VER the header length is non-standard */
1111.           OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
                ^
1112.                          ((s->version==DTLS1_BAD_VER)?3:DTLS1_CCS_HEADER_LENGTH)
1113.                          == (unsigned int)s->init_num);

ssl/statem/statem_dtls.c:1111:9: Condition is true
1109.       if (is_ccs) {
1110.           /* For DTLS1_BAD_VER the header length is non-standard */
1111.           OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
                ^
1112.                          ((s->version==DTLS1_BAD_VER)?3:DTLS1_CCS_HEADER_LENGTH)
1113.                          == (unsigned int)s->init_num);

ssl/statem/statem_dtls.c:1119:5: 
1117.       }
1118.   
1119. >     frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
1120.       frag->msg_header.seq = s->d1->w_msg_hdr.seq;
1121.       frag->msg_header.type = s->d1->w_msg_hdr.type;

ssl/statem/statem_dtls.c:1120:5: 
1118.   
1119.       frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
1120. >     frag->msg_header.seq = s->d1->w_msg_hdr.seq;
1121.       frag->msg_header.type = s->d1->w_msg_hdr.type;
1122.       frag->msg_header.frag_off = 0;

ssl/statem/statem_dtls.c:1121:5: 
1119.       frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
1120.       frag->msg_header.seq = s->d1->w_msg_hdr.seq;
1121. >     frag->msg_header.type = s->d1->w_msg_hdr.type;
1122.       frag->msg_header.frag_off = 0;
1123.       frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;

ssl/statem/statem_dtls.c:1122:5: 
1120.       frag->msg_header.seq = s->d1->w_msg_hdr.seq;
1121.       frag->msg_header.type = s->d1->w_msg_hdr.type;
1122. >     frag->msg_header.frag_off = 0;
1123.       frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
1124.       frag->msg_header.is_ccs = is_ccs;

ssl/statem/statem_dtls.c:1123:5: 
1121.       frag->msg_header.type = s->d1->w_msg_hdr.type;
1122.       frag->msg_header.frag_off = 0;
1123. >     frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
1124.       frag->msg_header.is_ccs = is_ccs;
1125.   

ssl/statem/statem_dtls.c:1124:5: 
1122.       frag->msg_header.frag_off = 0;
1123.       frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
1124. >     frag->msg_header.is_ccs = is_ccs;
1125.   
1126.       /* save current state */

ssl/statem/statem_dtls.c:1127:5: 
1125.   
1126.       /* save current state */
1127. >     frag->msg_header.saved_retransmit_state.enc_write_ctx = s->enc_write_ctx;
1128.       frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
1129.       frag->msg_header.saved_retransmit_state.compress = s->compress;

ssl/statem/statem_dtls.c:1128:5: 
1126.       /* save current state */
1127.       frag->msg_header.saved_retransmit_state.enc_write_ctx = s->enc_write_ctx;
1128. >     frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
1129.       frag->msg_header.saved_retransmit_state.compress = s->compress;
1130.       frag->msg_header.saved_retransmit_state.session = s->session;

ssl/statem/statem_dtls.c:1129:5: 
1127.       frag->msg_header.saved_retransmit_state.enc_write_ctx = s->enc_write_ctx;
1128.       frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
1129. >     frag->msg_header.saved_retransmit_state.compress = s->compress;
1130.       frag->msg_header.saved_retransmit_state.session = s->session;
1131.       frag->msg_header.saved_retransmit_state.epoch =

ssl/statem/statem_dtls.c:1130:5: 
1128.       frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
1129.       frag->msg_header.saved_retransmit_state.compress = s->compress;
1130. >     frag->msg_header.saved_retransmit_state.session = s->session;
1131.       frag->msg_header.saved_retransmit_state.epoch =
1132.           DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer);

ssl/statem/statem_dtls.c:1131:5: 
1129.       frag->msg_header.saved_retransmit_state.compress = s->compress;
1130.       frag->msg_header.saved_retransmit_state.session = s->session;
1131. >     frag->msg_header.saved_retransmit_state.epoch =
1132.           DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer);
1133.   

ssl/statem/statem_dtls.c:1134:5: 
1132.           DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer);
1133.   
1134. >     memset(seq64be, 0, sizeof(seq64be));
1135.       seq64be[6] =
1136.           (unsigned

ssl/statem/statem_dtls.c:1135:5: 
1133.   
1134.       memset(seq64be, 0, sizeof(seq64be));
1135. >     seq64be[6] =
1136.           (unsigned
1137.            char)(dtls1_get_queue_priority(frag->msg_header.seq,

ssl/statem/statem_dtls.c:1051:1: start of procedure dtls1_get_queue_priority()
  1049.   }
  1050.   
  1051. > int dtls1_get_queue_priority(unsigned short seq, int is_ccs)
  1052.   {
  1053.       /*

ssl/statem/statem_dtls.c:1063:5: 
  1061.        * priority queues) and fits in the unsigned short variable.
  1062.        */
  1063. >     return seq * 2 - is_ccs;
  1064.   }
  1065.   

ssl/statem/statem_dtls.c:1064:1: return from a call to dtls1_get_queue_priority
  1062.        */
  1063.       return seq * 2 - is_ccs;
  1064. > }
  1065.   
  1066.   int dtls1_retransmit_buffered_messages(SSL *s)

ssl/statem/statem_dtls.c:1139:5: 
1137.            char)(dtls1_get_queue_priority(frag->msg_header.seq,
1138.                                           frag->msg_header.is_ccs) >> 8);
1139. >     seq64be[7] =
1140.           (unsigned
1141.            char)(dtls1_get_queue_priority(frag->msg_header.seq,

ssl/statem/statem_dtls.c:1051:1: start of procedure dtls1_get_queue_priority()
  1049.   }
  1050.   
  1051. > int dtls1_get_queue_priority(unsigned short seq, int is_ccs)
  1052.   {
  1053.       /*

ssl/statem/statem_dtls.c:1063:5: 
  1061.        * priority queues) and fits in the unsigned short variable.
  1062.        */
  1063. >     return seq * 2 - is_ccs;
  1064.   }
  1065.   

ssl/statem/statem_dtls.c:1064:1: return from a call to dtls1_get_queue_priority
  1062.        */
  1063.       return seq * 2 - is_ccs;
  1064. > }
  1065.   
  1066.   int dtls1_retransmit_buffered_messages(SSL *s)

ssl/statem/statem_dtls.c:1144:5: 
1142.                                           frag->msg_header.is_ccs));
1143.   
1144. >     item = pitem_new(seq64be, frag);
1145.       if (item == NULL) {
1146.           dtls1_hm_fragment_free(frag);

ssl/pqueue.c:67:1: start of procedure pitem_new()
  65.   };
  66.   
  67. > pitem *pitem_new(unsigned char *prio64be, void *data)
  68.   {
  69.       pitem *item = OPENSSL_malloc(sizeof(*item));

ssl/pqueue.c:69:5: 
  67.   pitem *pitem_new(unsigned char *prio64be, void *data)
  68.   {
  69. >     pitem *item = OPENSSL_malloc(sizeof(*item));
  70.       if (item == NULL)
  71.           return NULL;

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
    117.   }
    118.   
    119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121.       void *ret = NULL;

crypto/mem.c:121:5: 
    119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121. >     void *ret = NULL;
    122.   
    123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
    121.       void *ret = NULL;
    122.   
    123.       if (num <= 0)
                   ^
    124.           return NULL;
    125.   

crypto/mem.c:126:5: 
    124.           return NULL;
    125.   
    126. >     allow_customize = 0;
    127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
    134.       }
    135.   #else
    136. >     (void)file;
    137.       (void)line;
    138.       ret = malloc(num);

crypto/mem.c:137:5: 
    135.   #else
    136.       (void)file;
    137. >     (void)line;
    138.       ret = malloc(num);
    139.   #endif

crypto/mem.c:138:5: 
    136.       (void)file;
    137.       (void)line;
    138. >     ret = malloc(num);
    139.   #endif
    140.   

crypto/mem.c:153:5: 
    151.   #endif
    152.   
    153. >     return ret;
    154.   }
    155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
    152.   
    153.       return ret;
    154. > }
    155.   
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/pqueue.c:70:9: Taking false branch
  68.   {
  69.       pitem *item = OPENSSL_malloc(sizeof(*item));
  70.       if (item == NULL)
                ^
  71.           return NULL;
  72.   

ssl/pqueue.c:73:5: 
  71.           return NULL;
  72.   
  73. >     memcpy(item->priority, prio64be, sizeof(item->priority));
  74.   
  75.       item->data = data;

ssl/pqueue.c:75:5: 
  73.       memcpy(item->priority, prio64be, sizeof(item->priority));
  74.   
  75. >     item->data = data;
  76.       item->next = NULL;
  77.   

ssl/pqueue.c:76:5: 
  74.   
  75.       item->data = data;
  76. >     item->next = NULL;
  77.   
  78.       return item;

ssl/pqueue.c:78:5: 
  76.       item->next = NULL;
  77.   
  78. >     return item;
  79.   }
  80.   

ssl/pqueue.c:79:1: return from a call to pitem_new
  77.   
  78.       return item;
  79. > }
  80.   
  81.   void pitem_free(pitem *item)

ssl/statem/statem_dtls.c:1145:9: Taking false branch
1143.   
1144.       item = pitem_new(seq64be, frag);
1145.       if (item == NULL) {
                ^
1146.           dtls1_hm_fragment_free(frag);
1147.           return 0;

ssl/statem/statem_dtls.c:1150:5: Skipping pqueue_insert(): empty list of specs
1148.       }
1149.   
1150.       pqueue_insert(s->d1->sent_messages, item);
            ^
1151.       return 1;
1152.   }
