There is a memory leak defect at line 3232 of the file /openssl/ssl/statem/statem_srvr.c.

[LuMingYinDetect]

At line 3197 of the file /openssl/ssl/statem/statem_srvr.c, a pointer variable named pkey_ctx is defined. This variable allocates a dynamic memory region through the function EVP_PKEY_CTX_new_from_pkey at line 3225. When the if statement at line 3226 returns false, it indicates that the dynamic memory region pointed to by pkey_ctx has been successfully allocated. However, if the if statement at line 3230 returns true, the program will return at line 3232 without executing the release operation for the dynamic memory region pointed to by pkey_ctx at line 3287. This leads to a memory leak defect, as shown in the diagram below:
https://github.com/LuMingYinDetect/openssl_defects/blob/main/openssl_22.png

[paulidale]

I wonder why Coverity isn't catching these.

[t8m]

I wonder why Coverity isn't catching these.

This is probably code not built in the coverity builds.