ssl/record/rec_layer_d1.c:313: error: MEMORY_LEAK
  memory dynamically allocated to `return` by call to `pitem_new()` at line 266, column 12 is not reachable after line 313, column 5.
Showing all 54 steps of the trace


ssl/record/rec_layer_d1.c:256:1: start of procedure dtls1_buffer_record()
254.   }
255.   
256. > int dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
257.   {
258.       DTLS1_RECORD_DATA *rdata;

ssl/record/rec_layer_d1.c:262:9: 
260.   
261.       /* Limit the size of the queue to prevent DOS attacks */
262. >     if (pqueue_size(queue->q) >= 100)
263.           return 0;
264.   

ssl/pqueue.c:207:1: start of procedure pqueue_size()
  205.   }
  206.   
  207. > int pqueue_size(pqueue *pq)
  208.   {
  209.       pitem *item = pq->items;

ssl/pqueue.c:209:5: 
  207.   int pqueue_size(pqueue *pq)
  208.   {
  209. >     pitem *item = pq->items;
  210.       int count = 0;
  211.   

ssl/pqueue.c:210:5: 
  208.   {
  209.       pitem *item = pq->items;
  210. >     int count = 0;
  211.   
  212.       while (item != NULL) {

ssl/pqueue.c:212:12: Loop condition is true. Entering loop body
  210.       int count = 0;
  211.   
  212.       while (item != NULL) {
                    ^
  213.           count++;
  214.           item = item->next;

ssl/pqueue.c:213:9: 
  211.   
  212.       while (item != NULL) {
  213. >         count++;
  214.           item = item->next;
  215.       }

ssl/pqueue.c:214:9: 
  212.       while (item != NULL) {
  213.           count++;
  214. >         item = item->next;
  215.       }
  216.       return count;

ssl/pqueue.c:212:12: Loop condition is false. Leaving loop
  210.       int count = 0;
  211.   
  212.       while (item != NULL) {
                    ^
  213.           count++;
  214.           item = item->next;

ssl/pqueue.c:216:5: 
  214.           item = item->next;
  215.       }
  216. >     return count;
  217.   }

ssl/pqueue.c:217:1: return from a call to pqueue_size
  215.       }
  216.       return count;
  217. > }

ssl/record/rec_layer_d1.c:262:9: Taking false branch
260.   
261.       /* Limit the size of the queue to prevent DOS attacks */
262.       if (pqueue_size(queue->q) >= 100)
               ^
263.           return 0;
264.   

ssl/record/rec_layer_d1.c:265:5: 
263.           return 0;
264.   
265. >     rdata = OPENSSL_malloc(sizeof(*rdata));
266.       item = pitem_new(priority, rdata);
267.       if (rdata == NULL || item == NULL) {

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
  117.   }
  118.   
  119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
  120.   {
  121.       void *ret = NULL;

crypto/mem.c:121:5: 
  119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
  120.   {
  121. >     void *ret = NULL;
  122.   
  123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
  121.       void *ret = NULL;
  122.   
  123.       if (num <= 0)
                 ^
  124.           return NULL;
  125.   

crypto/mem.c:126:5: 
  124.           return NULL;
  125.   
  126. >     allow_customize = 0;
  127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
  128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
  134.       }
  135.   #else
  136. >     (void)file;
  137.       (void)line;
  138.       ret = malloc(num);

crypto/mem.c:137:5: 
  135.   #else
  136.       (void)file;
  137. >     (void)line;
  138.       ret = malloc(num);
  139.   #endif

crypto/mem.c:138:5: 
  136.       (void)file;
  137.       (void)line;
  138. >     ret = malloc(num);
  139.   #endif
  140.   

crypto/mem.c:153:5: 
  151.   #endif
  152.   
  153. >     return ret;
  154.   }
  155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
  152.   
  153.       return ret;
  154. > }
  155.   
  156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/record/rec_layer_d1.c:266:5: 
264.   
265.       rdata = OPENSSL_malloc(sizeof(*rdata));
266. >     item = pitem_new(priority, rdata);
267.       if (rdata == NULL || item == NULL) {
268.           OPENSSL_free(rdata);

ssl/pqueue.c:67:1: start of procedure pitem_new()
  65.   };
  66.   
  67. > pitem *pitem_new(unsigned char *prio64be, void *data)
  68.   {
  69.       pitem *item = OPENSSL_malloc(sizeof(*item));

ssl/pqueue.c:69:5: 
  67.   pitem *pitem_new(unsigned char *prio64be, void *data)
  68.   {
  69. >     pitem *item = OPENSSL_malloc(sizeof(*item));
  70.       if (item == NULL)
  71.           return NULL;

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
    117.   }
    118.   
    119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121.       void *ret = NULL;

crypto/mem.c:121:5: 
    119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121. >     void *ret = NULL;
    122.   
    123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
    121.       void *ret = NULL;
    122.   
    123.       if (num <= 0)
                   ^
    124.           return NULL;
    125.   

crypto/mem.c:126:5: 
    124.           return NULL;
    125.   
    126. >     allow_customize = 0;
    127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
    134.       }
    135.   #else
    136. >     (void)file;
    137.       (void)line;
    138.       ret = malloc(num);

crypto/mem.c:137:5: 
    135.   #else
    136.       (void)file;
    137. >     (void)line;
    138.       ret = malloc(num);
    139.   #endif

crypto/mem.c:138:5: 
    136.       (void)file;
    137.       (void)line;
    138. >     ret = malloc(num);
    139.   #endif
    140.   

crypto/mem.c:153:5: 
    151.   #endif
    152.   
    153. >     return ret;
    154.   }
    155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
    152.   
    153.       return ret;
    154. > }
    155.   
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/pqueue.c:70:9: Taking false branch
  68.   {
  69.       pitem *item = OPENSSL_malloc(sizeof(*item));
  70.       if (item == NULL)
                ^
  71.           return NULL;
  72.   

ssl/pqueue.c:73:5: 
  71.           return NULL;
  72.   
  73. >     memcpy(item->priority, prio64be, sizeof(item->priority));
  74.   
  75.       item->data = data;

ssl/pqueue.c:75:5: 
  73.       memcpy(item->priority, prio64be, sizeof(item->priority));
  74.   
  75. >     item->data = data;
  76.       item->next = NULL;
  77.   

ssl/pqueue.c:76:5: 
  74.   
  75.       item->data = data;
  76. >     item->next = NULL;
  77.   
  78.       return item;

ssl/pqueue.c:78:5: 
  76.       item->next = NULL;
  77.   
  78. >     return item;
  79.   }
  80.   

ssl/pqueue.c:79:1: return from a call to pitem_new
  77.   
  78.       return item;
  79. > }
  80.   
  81.   void pitem_free(pitem *item)

ssl/record/rec_layer_d1.c:267:9: Taking false branch
265.       rdata = OPENSSL_malloc(sizeof(*rdata));
266.       item = pitem_new(priority, rdata);
267.       if (rdata == NULL || item == NULL) {
               ^
268.           OPENSSL_free(rdata);
269.           pitem_free(item);

ssl/record/rec_layer_d1.c:267:26: Taking false branch
265.       rdata = OPENSSL_malloc(sizeof(*rdata));
266.       item = pitem_new(priority, rdata);
267.       if (rdata == NULL || item == NULL) {
                                ^
268.           OPENSSL_free(rdata);
269.           pitem_free(item);

ssl/record/rec_layer_d1.c:274:5: 
272.       }
273.   
274. >     rdata->packet = s->rlayer.packet;
275.       rdata->packet_length = s->rlayer.packet_length;
276.       memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));

ssl/record/rec_layer_d1.c:275:5: 
273.   
274.       rdata->packet = s->rlayer.packet;
275. >     rdata->packet_length = s->rlayer.packet_length;
276.       memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
277.       memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));

ssl/record/rec_layer_d1.c:276:5: 
274.       rdata->packet = s->rlayer.packet;
275.       rdata->packet_length = s->rlayer.packet_length;
276. >     memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
277.       memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
278.   

ssl/record/rec_layer_d1.c:277:5: 
275.       rdata->packet_length = s->rlayer.packet_length;
276.       memcpy(&(rdata->rbuf), &s->rlayer.rbuf, sizeof(SSL3_BUFFER));
277. >     memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
278.   
279.       item->data = rdata;

ssl/record/rec_layer_d1.c:279:5: 
277.       memcpy(&(rdata->rrec), &s->rlayer.rrec, sizeof(SSL3_RECORD));
278.   
279. >     item->data = rdata;
280.   
281.   #ifndef OPENSSL_NO_SCTP

ssl/record/rec_layer_d1.c:291:5: 
289.   #endif
290.   
291. >     s->rlayer.packet = NULL;
292.       s->rlayer.packet_length = 0;
293.       memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));

ssl/record/rec_layer_d1.c:292:5: 
290.   
291.       s->rlayer.packet = NULL;
292. >     s->rlayer.packet_length = 0;
293.       memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
294.       memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));

ssl/record/rec_layer_d1.c:293:5: 
291.       s->rlayer.packet = NULL;
292.       s->rlayer.packet_length = 0;
293. >     memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
294.       memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
295.   

ssl/record/rec_layer_d1.c:294:5: 
292.       s->rlayer.packet_length = 0;
293.       memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
294. >     memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
295.   
296.       if (!ssl3_setup_buffers(s)) {

ssl/record/rec_layer_d1.c:296:10: Taking false branch
294.       memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
295.   
296.       if (!ssl3_setup_buffers(s)) {
                ^
297.           SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
298.           OPENSSL_free(rdata->rbuf.buf);

ssl/record/rec_layer_d1.c:305:9: Taking false branch
303.   
304.       /* insert should not fail, since duplicates are dropped */
305.       if (pqueue_insert(queue->q, item) == NULL) {
               ^
306.           SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
307.           OPENSSL_free(rdata->rbuf.buf);

ssl/record/rec_layer_d1.c:313:5: 
311.       }
312.   
313. >     return (1);
314.   }
315.   
