From 738454dc4227f41bef4cdeac4448a2f2dfbfa93f Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Fri, 31 Jul 2026 15:25:11 +0200 Subject: [PATCH] memory: remove unreachable res operand in wolfSSL_Realloc Premise: memory.c:1337 `void* res = 0;` -- and every subsequent write to res lies on a path that cannot reach the claimed condition. Claim: memory.c:1414 `if (pt != NULL && res == NULL)` -- the `res == NULL` operand. Proof: res is assigned in exactly two places before :1414. (a) :1353 `res = realloc(ptr, size)` sits inside the `if (heap == NULL && globalHeapHint == NULL)` arm at :1348, while :1414 sits inside that if's else arm -- mutually exclusive. (b) :1394/:1397 sit in the fixed-IO-pool arm at :1387, while :1414 sits in the `/* general memory */` else arm at :1402 -- again mutually exclusive. Everything else on the path either returns (the WOLFSSL_HEAP_TEST shortcut at :1342, the ptr == NULL case at :1371, the mutex-lock failure at :1379) or writes only pt / i / mem->ava[]. So res still holds its 0 initialiser at every evaluation of :1414: the operand is invariantly true and its independence pair is unreachable. Scope: checked against every combination of WOLFSSL_STATIC_MEMORY, WOLFSSL_STATIC_MEMORY_LEAN, WOLFSSL_DEBUG_MEMORY, WOLFSSL_HEAP_TEST, WOLFSSL_NO_MALLOC, SINGLE_THREADED and WOLFSSL_MALLOC_CHECK. Under WOLFSSL_STATIC_MEMORY_LEAN the #ifndef at :1385 deletes both the IO-pool arm and its else, making the :1402 block unconditional -- and deleting writes (b) along with it, so the argument only gets stronger. XREALLOC overrides in types.h either route to this function or replace it wholesale; neither can enter it mid-body. Evidence: llvm-cov MC/DC records this condition's pair as uncovered (reports/infra/GAPS.md row 1414:17:1414:42:1). Compiler cross-check: gcc -O2 emits byte-identical code for this file before and after this commit -- the optimiser had already folded the removed condition, independently confirming it was dead. --- wolfcrypt/src/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wolfcrypt/src/memory.c b/wolfcrypt/src/memory.c index 4b06cb9dee..26766d1d34 100644 --- a/wolfcrypt/src/memory.c +++ b/wolfcrypt/src/memory.c @@ -1411,7 +1411,7 @@ void* wolfSSL_Realloc(void *ptr, size_t size, void* heap, int type) } } - if (pt != NULL && res == NULL) { + if (pt != NULL) { word32 prvSz; res = pt->buffer;