Exclude a few lines from lcov coverage stats:archive/lcov

- "fail" branches in selftests
- "should never happen" errors in SSL
- cipher_xxx() failures in SSL
- some things that fail only if malloc() fails
- some things that fail only if fread/fwrite()/ftell() fails
  (after fopen() succeeded)
- some things that fail only if a parameter is invalid, but the parameter was
  actually validated earlier
- generated code in library/error.c

43 files changed, 307 insertions, 287 deletions

diff --git a/library/aes.c b/library/aes.c
index ec9313d..a50db5b 100644
--- a/library/aes.c
+++ b/library/aes.c
@@ -1261,13 +1261,13 @@ int mbedtls_aes_self_test( int verbose )
                 mbedtls_aes_crypt_ecb( &ctx, v, buf, buf );
 
             if( memcmp( buf, aes_test_ecb_dec[u], 16 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
         }
         else
         {
@@ -1277,13 +1277,13 @@ int mbedtls_aes_self_test( int verbose )
                 mbedtls_aes_crypt_ecb( &ctx, v, buf, buf );
 
             if( memcmp( buf, aes_test_ecb_enc[u], 16 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
         }
 
         if( verbose != 0 )
@@ -1318,13 +1318,13 @@ int mbedtls_aes_self_test( int verbose )
                 mbedtls_aes_crypt_cbc( &ctx, v, 16, iv, buf, buf );
 
             if( memcmp( buf, aes_test_cbc_dec[u], 16 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
         }
         else
         {
@@ -1342,13 +1342,13 @@ int mbedtls_aes_self_test( int verbose )
             }
 
             if( memcmp( prv, aes_test_cbc_enc[u], 16 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
         }
 
         if( verbose != 0 )
@@ -1384,13 +1384,13 @@ int mbedtls_aes_self_test( int verbose )
             mbedtls_aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
 
             if( memcmp( buf, aes_test_cfb128_pt, 64 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
         }
         else
         {
@@ -1398,13 +1398,13 @@ int mbedtls_aes_self_test( int verbose )
             mbedtls_aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
 
             if( memcmp( buf, aes_test_cfb128_ct[u], 64 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
         }
 
         if( verbose != 0 )
@@ -1443,13 +1443,13 @@ int mbedtls_aes_self_test( int verbose )
                            buf, buf );
 
             if( memcmp( buf, aes_test_ctr_pt[u], len ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
         }
         else
         {
@@ -1460,13 +1460,13 @@ int mbedtls_aes_self_test( int verbose )
                            buf, buf );
 
             if( memcmp( buf, aes_test_ctr_ct[u], len ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
         }
 
         if( verbose != 0 )
diff --git a/library/arc4.c b/library/arc4.c
index ff0e993..a4879c7 100644
--- a/library/arc4.c
+++ b/library/arc4.c
@@ -179,13 +179,13 @@ int mbedtls_arc4_self_test( int verbose )
         mbedtls_arc4_crypt( &ctx, 8, ibuf, obuf );
 
         if( memcmp( obuf, arc4_test_ct[i], 8 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/asn1parse.c b/library/asn1parse.c
index b37523d..16d81f7 100644
--- a/library/asn1parse.c
+++ b/library/asn1parse.c
@@ -272,7 +272,7 @@ int mbedtls_asn1_get_sequence_of( unsigned char **p,
             cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
             if( cur->next == NULL )
-                return( MBEDTLS_ERR_ASN1_ALLOC_FAILED );
+                return( MBEDTLS_ERR_ASN1_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
             cur = cur->next;
         }
diff --git a/library/asn1write.c b/library/asn1write.c
index dd5a745..db0c53a 100644
--- a/library/asn1write.c
+++ b/library/asn1write.c
@@ -313,26 +313,26 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data
         // Add new entry if not present yet based on OID
         //
         if( ( cur = mbedtls_calloc( 1, sizeof(mbedtls_asn1_named_data) ) ) == NULL )
-            return( NULL );
+            return( NULL ); // LCOV_EXCL_LINE
 
         cur->oid.len = oid_len;
         cur->oid.p = mbedtls_calloc( 1, oid_len );
         if( cur->oid.p == NULL )
-        {
+        { // LCOV_EXCL_START
             mbedtls_free( cur );
             return( NULL );
-        }
+        } // LCOV_EXCL_STOP
 
         memcpy( cur->oid.p, oid, oid_len );
 
         cur->val.len = val_len;
         cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
-        {
+        { // LCOV_EXCL_START
             mbedtls_free( cur->oid.p );
             mbedtls_free( cur );
             return( NULL );
-        }
+        } // LCOV_EXCL_STOP
 
         cur->next = *head;
         *head = cur;
@@ -347,11 +347,11 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data
         cur->val.len = val_len;
         cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
-        {
+        { // LCOV_EXCL_START
             mbedtls_free( cur->oid.p );
             mbedtls_free( cur );
             return( NULL );
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( val != NULL )
diff --git a/library/base64.c b/library/base64.c
index 16c254d..d599a0f 100644
--- a/library/base64.c
+++ b/library/base64.c
@@ -251,12 +251,12 @@ int mbedtls_base64_self_test( int verbose )
 
     if( mbedtls_base64_encode( buffer, sizeof( buffer ), &len, src, 64 ) != 0 ||
          memcmp( base64_test_enc, buffer, 88 ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( 1 );
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n  Base64 decoding test: " );
@@ -265,12 +265,12 @@ int mbedtls_base64_self_test( int verbose )
 
     if( mbedtls_base64_decode( buffer, sizeof( buffer ), &len, src, 88 ) != 0 ||
          memcmp( base64_test_dec, buffer, 64 ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( 1 );
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n\n" );
diff --git a/library/bignum.c b/library/bignum.c
index 15cbf73..4b291d7 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -109,7 +109,7 @@ int mbedtls_mpi_grow( mbedtls_mpi *X, size_t nblimbs )
     if( X->n < nblimbs )
     {
         if( ( p = mbedtls_calloc( nblimbs, ciL ) ) == NULL )
-            return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+            return( MBEDTLS_ERR_MPI_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
         if( X->p != NULL )
         {
@@ -147,7 +147,7 @@ int mbedtls_mpi_shrink( mbedtls_mpi *X, size_t nblimbs )
         i = nblimbs;
 
     if( ( p = mbedtls_calloc( i, ciL ) ) == NULL )
-        return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+        return( MBEDTLS_ERR_MPI_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     if( X->p != NULL )
     {
@@ -619,7 +619,7 @@ int mbedtls_mpi_write_file( const char *p, const mbedtls_mpi *X, int radix, FILE
     {
         if( fwrite( p, 1, plen, fout ) != plen ||
             fwrite( s, 1, slen, fout ) != slen )
-            return( MBEDTLS_ERR_MPI_FILE_IO_ERROR );
+            return( MBEDTLS_ERR_MPI_FILE_IO_ERROR ); // LCOV_EXCL_LINE
     }
     else
         mbedtls_printf( "%s%s", p, s );
@@ -2232,13 +2232,13 @@ int mbedtls_mpi_self_test( int verbose )
         mbedtls_printf( "  MPI test #1 (mul_mpi): " );
 
     if( mbedtls_mpi_cmp_mpi( &X, &U ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         ret = 1;
         goto cleanup;
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n" );
@@ -2258,13 +2258,13 @@ int mbedtls_mpi_self_test( int verbose )
 
     if( mbedtls_mpi_cmp_mpi( &X, &U ) != 0 ||
         mbedtls_mpi_cmp_mpi( &Y, &V ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         ret = 1;
         goto cleanup;
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n" );
@@ -2280,13 +2280,13 @@ int mbedtls_mpi_self_test( int verbose )
         mbedtls_printf( "  MPI test #3 (exp_mod): " );
 
     if( mbedtls_mpi_cmp_mpi( &X, &U ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         ret = 1;
         goto cleanup;
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n" );
@@ -2302,13 +2302,13 @@ int mbedtls_mpi_self_test( int verbose )
         mbedtls_printf( "  MPI test #4 (inv_mod): " );
 
     if( mbedtls_mpi_cmp_mpi( &X, &U ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         ret = 1;
         goto cleanup;
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n" );
@@ -2324,13 +2324,13 @@ int mbedtls_mpi_self_test( int verbose )
         MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &A, &X, &Y ) );
 
         if( mbedtls_mpi_cmp_int( &A, gcd_pairs[i][2] ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed at %d\n", i );
 
             ret = 1;
             goto cleanup;
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( verbose != 0 )
@@ -2339,7 +2339,7 @@ int mbedtls_mpi_self_test( int verbose )
 cleanup:
 
     if( ret != 0 && verbose != 0 )
-        mbedtls_printf( "Unexpected error, return code = %08X\n", ret );
+        mbedtls_printf( "Unexpected error, return code = %08X\n", ret ); // LCOV_EXCL_LINE
 
     mbedtls_mpi_free( &A ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &N ); mbedtls_mpi_free( &X );
     mbedtls_mpi_free( &Y ); mbedtls_mpi_free( &U ); mbedtls_mpi_free( &V );
diff --git a/library/camellia.c b/library/camellia.c
index e015ca2..226c7b1 100644
--- a/library/camellia.c
+++ b/library/camellia.c
@@ -935,12 +935,12 @@ int mbedtls_camellia_self_test( int verbose )
         mbedtls_camellia_crypt_ecb( &ctx, v, src, buf );
 
         if( memcmp( buf, dst, 16 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( verbose != 0 )
@@ -988,12 +988,12 @@ int mbedtls_camellia_self_test( int verbose )
         mbedtls_camellia_crypt_cbc( &ctx, v, 16, iv, src, buf );
 
         if( memcmp( buf, dst, 16 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
     }
 
         if( verbose != 0 )
@@ -1032,12 +1032,12 @@ int mbedtls_camellia_self_test( int verbose )
                                 buf, buf );
 
             if( memcmp( buf, camellia_test_ctr_pt[u], len ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 return( 1 );
-            }
+            } // LCOV_EXCL_STOP
         }
         else
         {
@@ -1048,12 +1048,12 @@ int mbedtls_camellia_self_test( int verbose )
                                 buf, buf );
 
             if( memcmp( buf, camellia_test_ctr_ct[u], len ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 return( 1 );
-            }
+            } // LCOV_EXCL_STOP
         }
 
         if( verbose != 0 )
diff --git a/library/ccm.c b/library/ccm.c
index 3463a0b..f845b4e 100644
--- a/library/ccm.c
+++ b/library/ccm.c
@@ -83,12 +83,12 @@ int mbedtls_ccm_setkey( mbedtls_ccm_context *ctx,
     mbedtls_cipher_free( &ctx->cipher_ctx );
 
     if( ( ret = mbedtls_cipher_setup( &ctx->cipher_ctx, cipher_info ) ) != 0 )
-        return( ret );
+        return( ret ); // LCOV_EXCL_LINE (fails only if malloc fails of cipher_info is NULL)
 
     if( ( ret = mbedtls_cipher_setkey( &ctx->cipher_ctx, key, keybits,
                                MBEDTLS_ENCRYPT ) ) != 0 )
     {
-        return( ret );
+        return( ret ); // LCOV_EXCL_LINE (fails only on bad key size, already tested by cipher_info_from_values())
     }
 
     return( 0 );
@@ -407,12 +407,12 @@ int mbedtls_ccm_self_test( int verbose )
     mbedtls_ccm_init( &ctx );
 
     if( mbedtls_ccm_setkey( &ctx, MBEDTLS_CIPHER_ID_AES, key, 8 * sizeof key ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "  CCM: setup failed" );
 
         return( 1 );
-    }
+    } // LCOV_EXCL_STOP
 
     for( i = 0; i < NB_TESTS; i++ )
     {
@@ -426,12 +426,12 @@ int mbedtls_ccm_self_test( int verbose )
 
         if( ret != 0 ||
             memcmp( out, res[i], msg_len[i] + tag_len[i] ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
 
         ret = mbedtls_ccm_auth_decrypt( &ctx, msg_len[i],
                                 iv, iv_len[i], ad, add_len[i],
@@ -440,12 +440,12 @@ int mbedtls_ccm_self_test( int verbose )
 
         if( ret != 0 ||
             memcmp( out, msg, msg_len[i] ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/cipher.c b/library/cipher.c
index ccc0685..ecc3aec 100644
--- a/library/cipher.c
+++ b/library/cipher.c
@@ -141,7 +141,7 @@ int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx, const mbedtls_cipher_in
     memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
 
     if( NULL == ( ctx->cipher_ctx = cipher_info->base->ctx_alloc_func() ) )
-        return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
+        return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     ctx->cipher_info = cipher_info;
 
diff --git a/library/ctr_drbg.c b/library/ctr_drbg.c
index aefddfa..a24db3e 100644
--- a/library/ctr_drbg.c
+++ b/library/ctr_drbg.c
@@ -429,10 +429,10 @@ int mbedtls_ctr_drbg_write_seed_file( mbedtls_ctr_drbg_context *ctx, const char
         goto exit;
 
     if( fwrite( buf, 1, MBEDTLS_CTR_DRBG_MAX_INPUT, f ) != MBEDTLS_CTR_DRBG_MAX_INPUT )
-    {
+    { // LCOV_EXCL_START
         ret = MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR;
         goto exit;
-    }
+    } // LCOV_EXCL_STOP
 
     ret = 0;
 
@@ -461,10 +461,10 @@ int mbedtls_ctr_drbg_update_seed_file( mbedtls_ctr_drbg_context *ctx, const char
     }
 
     if( fread( buf, 1, n, f ) != n )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         return( MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     fclose( f );
 
diff --git a/library/des.c b/library/des.c
index 61f214a..da57b89 100644
--- a/library/des.c
+++ b/library/des.c
@@ -937,13 +937,13 @@ int mbedtls_des_self_test( int verbose )
                 memcmp( buf, des3_test_ecb_dec[u], 8 ) != 0 ) ||
             ( v != MBEDTLS_DES_DECRYPT &&
                 memcmp( buf, des3_test_ecb_enc[u], 8 ) != 0 ) )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
@@ -1033,13 +1033,13 @@ int mbedtls_des_self_test( int verbose )
                 memcmp( buf, des3_test_cbc_dec[u], 8 ) != 0 ) ||
             ( v != MBEDTLS_DES_DECRYPT &&
                 memcmp( buf, des3_test_cbc_enc[u], 8 ) != 0 ) )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/dhm.c b/library/dhm.c
index 0f4d316..7ed56a5 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -521,27 +521,27 @@ static int load_file( const char *path, unsigned char **buf, size_t *n )
 
     fseek( f, 0, SEEK_END );
     if( ( size = ftell( f ) ) == -1 )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
-    }
+    } // LCOV_EXCL_STOP
     fseek( f, 0, SEEK_SET );
 
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
         ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         return( MBEDTLS_ERR_DHM_ALLOC_FAILED );
-    }
+    } // LCOV_EXCL_STOP
 
     if( fread( *buf, 1, *n, f ) != *n )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         mbedtls_free( *buf );
         return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     fclose( f );
 
@@ -602,13 +602,13 @@ int mbedtls_dhm_self_test( int verbose )
     if( ( ret = mbedtls_dhm_parse_dhm( &dhm,
                     (const unsigned char *) mbedtls_test_dhm_params,
                     mbedtls_test_dhm_params_len ) ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         ret = 1;
         goto exit;
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n\n" );
diff --git a/library/ecp.c b/library/ecp.c
index 858540b..b352376 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -780,7 +780,7 @@ static int ecp_normalize_jac_many( const mbedtls_ecp_group *grp,
         return( ecp_normalize_jac( grp, *T ) );
 
     if( ( c = mbedtls_calloc( t_len, sizeof( mbedtls_mpi ) ) ) == NULL )
-        return( MBEDTLS_ERR_ECP_ALLOC_FAILED );
+        return( MBEDTLS_ERR_ECP_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     mbedtls_mpi_init( &u ); mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
 
@@ -1352,10 +1352,10 @@ static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
     {
         T = mbedtls_calloc( pre_len, sizeof( mbedtls_ecp_point ) );
         if( T == NULL )
-        {
+        { // LCOV_EXCL_START
             ret = MBEDTLS_ERR_ECP_ALLOC_FAILED;
             goto cleanup;
-        }
+        } // LCOV_EXCL_STOP
 
         MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d ) );
 
@@ -1958,13 +1958,13 @@ int mbedtls_ecp_self_test( int verbose )
         if( add_count != add_c_prev ||
             dbl_count != dbl_c_prev ||
             mul_count != mul_c_prev )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed (%u)\n", (unsigned int) i );
 
             ret = 1;
             goto cleanup;
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( verbose != 0 )
@@ -1995,13 +1995,13 @@ int mbedtls_ecp_self_test( int verbose )
         if( add_count != add_c_prev ||
             dbl_count != dbl_c_prev ||
             mul_count != mul_c_prev )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed (%u)\n", (unsigned int) i );
 
             ret = 1;
             goto cleanup;
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( verbose != 0 )
diff --git a/library/entropy.c b/library/entropy.c
index cdbd35c..b6fff7e 100644
--- a/library/entropy.c
+++ b/library/entropy.c
@@ -360,10 +360,10 @@ int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *p
         goto exit;
 
     if( fwrite( buf, 1, MBEDTLS_ENTROPY_BLOCK_SIZE, f ) != MBEDTLS_ENTROPY_BLOCK_SIZE )
-    {
+    { // LCOV_EXCL_START
         ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
         goto exit;
-    }
+    } // LCOV_EXCL_STOP
 
     ret = 0;
 
@@ -389,10 +389,10 @@ int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *
         n = MBEDTLS_ENTROPY_MAX_SEED_SIZE;
 
     if( fread( buf, 1, n, f ) != n )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     fclose( f );
 
@@ -437,15 +437,15 @@ int mbedtls_entropy_self_test( int verbose )
 
     /* First do a gather to make sure we have default sources */
     if( ( ret = mbedtls_entropy_gather( &ctx ) ) != 0 )
-        goto cleanup;
+        goto cleanup; // LCOV_EXCL_LINE
 
     ret = mbedtls_entropy_add_source( &ctx, entropy_dummy_source, NULL, 16,
                                       MBEDTLS_ENTROPY_SOURCE_WEAK );
     if( ret != 0 )
-        goto cleanup;
+        goto cleanup; // LCOV_EXCL_LINE
 
     if( ( ret = mbedtls_entropy_update_manual( &ctx, buf, sizeof buf ) ) != 0 )
-        goto cleanup;
+        goto cleanup; // LCOV_EXCL_LINE
 
     /*
      * To test that mbedtls_entropy_func writes correct number of bytes:
@@ -458,7 +458,7 @@ int mbedtls_entropy_self_test( int verbose )
     for( i = 0; i < 8; i++ )
     {
         if( ( ret = mbedtls_entropy_func( &ctx, buf, sizeof( buf ) ) ) != 0 )
-            goto cleanup;
+            goto cleanup; // LCOV_EXCL_LINE
 
         for( j = 0; j < sizeof( buf ); j++ )
             acc[j] |= buf[j];
@@ -467,10 +467,10 @@ int mbedtls_entropy_self_test( int verbose )
     for( j = 0; j < sizeof( buf ); j++ )
     {
         if( acc[j] == 0 )
-        {
+        { // LCOV_EXCL_START
             ret = 1;
             goto cleanup;
-        }
+        } // LCOV_EXCL_STOP
     }
 
 cleanup:
@@ -479,7 +479,7 @@ cleanup:
     if( verbose != 0 )
     {
         if( ret != 0 )
-            mbedtls_printf( "failed\n" );
+            mbedtls_printf( "failed\n" ); // LCOV_EXCL_LINE
         else
             mbedtls_printf( "passed\n" );
 
diff --git a/library/entropy_poll.c b/library/entropy_poll.c
index 25a27be..6aa0a01 100644
--- a/library/entropy_poll.c
+++ b/library/entropy_poll.c
@@ -166,10 +166,10 @@ int mbedtls_platform_entropy_poll( void *data,
 
     read_len = fread( output, 1, len, file );
     if( read_len != len )
-    {
+    { // LCOV_EXCL_START
         fclose( file );
         return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
-    }
+    } // LCOV_EXCL_STOP
 
     fclose( file );
     *olen = len;
diff --git a/library/error.c b/library/error.c
index a1cf83a..7f4410d 100644
--- a/library/error.c
+++ b/library/error.c
@@ -169,6 +169,7 @@ void mbedtls_strerror( int ret, char *buf, size_t buflen )
         // High level error codes
         //
         // BEGIN generated code
+        // LCOV_EXCL_START
 #if defined(MBEDTLS_CIPHER_C)
         if( use_ret == -(MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE) )
             mbedtls_snprintf( buf, buflen, "CIPHER - The selected feature is not available" );
@@ -472,6 +473,7 @@ void mbedtls_strerror( int ret, char *buf, size_t buflen )
         if( use_ret == -(MBEDTLS_ERR_X509_BUFFER_TOO_SMALL) )
             mbedtls_snprintf( buf, buflen, "X509 - Destination buffer is too small" );
 #endif /* MBEDTLS_X509_USE_C || MBEDTLS_X509_CREATE_C */
+        // LCOV_EXCL_STOP
         // END generated code
 
         if( strlen( buf ) == 0 )
@@ -502,6 +504,7 @@ void mbedtls_strerror( int ret, char *buf, size_t buflen )
     // Low level error codes
     //
     // BEGIN generated code
+    // LCOV_EXCL_START
 #if defined(MBEDTLS_AES_C)
     if( use_ret == -(MBEDTLS_ERR_AES_INVALID_KEY_LENGTH) )
         mbedtls_snprintf( buf, buflen, "AES - Invalid key length" );
@@ -670,6 +673,7 @@ void mbedtls_strerror( int ret, char *buf, size_t buflen )
     if( use_ret == -(MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH) )
         mbedtls_snprintf( buf, buflen, "XTEA - The data input has an invalid length" );
 #endif /* MBEDTLS_XTEA_C */
+    // LCOV_EXCL_STOP
     // END generated code
 
     if( strlen( buf ) != 0 )
diff --git a/library/gcm.c b/library/gcm.c
index 4298254..51d8ec7 100644
--- a/library/gcm.c
+++ b/library/gcm.c
@@ -766,12 +766,12 @@ int mbedtls_gcm_self_test( int verbose )
             if( ret != 0 ||
                 memcmp( buf, ct[j * 6 + i], pt_len[i] ) != 0 ||
                 memcmp( tag_buf, tag[j * 6 + i], 16 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 return( 1 );
-            }
+            } // LCOV_EXCL_STOP
 
             mbedtls_gcm_free( &ctx );
 
@@ -793,12 +793,12 @@ int mbedtls_gcm_self_test( int verbose )
             if( ret != 0 ||
                 memcmp( buf, pt[pt_index[i]], pt_len[i] ) != 0 ||
                 memcmp( tag_buf, tag[j * 6 + i], 16 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 return( 1 );
-            }
+            } // LCOV_EXCL_STOP
 
             mbedtls_gcm_free( &ctx );
 
@@ -815,57 +815,57 @@ int mbedtls_gcm_self_test( int verbose )
                               iv[iv_index[i]], iv_len[i],
                               additional[add_index[i]], add_len[i] );
             if( ret != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 return( 1 );
-            }
+            } // LCOV_EXCL_STOP
 
             if( pt_len[i] > 32 )
             {
                 size_t rest_len = pt_len[i] - 32;
                 ret = mbedtls_gcm_update( &ctx, 32, pt[pt_index[i]], buf );
                 if( ret != 0 )
-                {
+                { // LCOV_EXCL_START
                     if( verbose != 0 )
                         mbedtls_printf( "failed\n" );
 
                     return( 1 );
-                }
+                } // LCOV_EXCL_STOP
 
                 ret = mbedtls_gcm_update( &ctx, rest_len, pt[pt_index[i]] + 32,
                                   buf + 32 );
                 if( ret != 0 )
-                {
+                { // LCOV_EXCL_START
                     if( verbose != 0 )
                         mbedtls_printf( "failed\n" );
 
                     return( 1 );
-                }
+                } // LCOV_EXCL_STOP
             }
             else
             {
                 ret = mbedtls_gcm_update( &ctx, pt_len[i], pt[pt_index[i]], buf );
                 if( ret != 0 )
-                {
+                { // LCOV_EXCL_START
                     if( verbose != 0 )
                         mbedtls_printf( "failed\n" );
 
                     return( 1 );
-                }
+                } // LCOV_EXCL_STOP
             }
 
             ret = mbedtls_gcm_finish( &ctx, tag_buf, 16 );
             if( ret != 0 ||
                 memcmp( buf, ct[j * 6 + i], pt_len[i] ) != 0 ||
                 memcmp( tag_buf, tag[j * 6 + i], 16 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 return( 1 );
-            }
+            } // LCOV_EXCL_STOP
 
             mbedtls_gcm_free( &ctx );
 
@@ -882,57 +882,57 @@ int mbedtls_gcm_self_test( int verbose )
                               iv[iv_index[i]], iv_len[i],
                               additional[add_index[i]], add_len[i] );
             if( ret != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 return( 1 );
-            }
+            } // LCOV_EXCL_STOP
 
             if( pt_len[i] > 32 )
             {
                 size_t rest_len = pt_len[i] - 32;
                 ret = mbedtls_gcm_update( &ctx, 32, ct[j * 6 + i], buf );
                 if( ret != 0 )
-                {
+                { // LCOV_EXCL_START
                     if( verbose != 0 )
                         mbedtls_printf( "failed\n" );
 
                     return( 1 );
-                }
+                } // LCOV_EXCL_STOP
 
                 ret = mbedtls_gcm_update( &ctx, rest_len, ct[j * 6 + i] + 32,
                                   buf + 32 );
                 if( ret != 0 )
-                {
+                { // LCOV_EXCL_START
                     if( verbose != 0 )
                         mbedtls_printf( "failed\n" );
 
                     return( 1 );
-                }
+                } // LCOV_EXCL_STOP
             }
             else
             {
                 ret = mbedtls_gcm_update( &ctx, pt_len[i], ct[j * 6 + i], buf );
                 if( ret != 0 )
-                {
+                { // LCOV_EXCL_START
                     if( verbose != 0 )
                         mbedtls_printf( "failed\n" );
 
                     return( 1 );
-                }
+                } // LCOV_EXCL_STOP
             }
 
             ret = mbedtls_gcm_finish( &ctx, tag_buf, 16 );
             if( ret != 0 ||
                 memcmp( buf, pt[pt_index[i]], pt_len[i] ) != 0 ||
                 memcmp( tag_buf, tag[j * 6 + i], 16 ) != 0 )
-            {
+            { // LCOV_EXCL_START
                 if( verbose != 0 )
                     mbedtls_printf( "failed\n" );
 
                 return( 1 );
-            }
+            } // LCOV_EXCL_STOP
 
             mbedtls_gcm_free( &ctx );
 
diff --git a/library/hmac_drbg.c b/library/hmac_drbg.c
index bf5f9b5..2961750 100644
--- a/library/hmac_drbg.c
+++ b/library/hmac_drbg.c
@@ -355,10 +355,10 @@ int mbedtls_hmac_drbg_write_seed_file( mbedtls_hmac_drbg_context *ctx, const cha
         goto exit;
 
     if( fwrite( buf, 1, sizeof( buf ), f ) != sizeof( buf ) )
-    {
+    { // LCOV_EXCL_START
         ret = MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR;
         goto exit;
-    }
+    } // LCOV_EXCL_STOP
 
     ret = 0;
 
@@ -387,10 +387,10 @@ int mbedtls_hmac_drbg_update_seed_file( mbedtls_hmac_drbg_context *ctx, const ch
     }
 
     if( fread( buf, 1, n, f ) != n )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         return( MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     fclose( f );
 
diff --git a/library/md.c b/library/md.c
index eda98f6..f970231 100644
--- a/library/md.c
+++ b/library/md.c
@@ -228,16 +228,16 @@ int mbedtls_md_setup( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_inf
         return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
 
     if( ( ctx->md_ctx = md_info->ctx_alloc_func() ) == NULL )
-        return( MBEDTLS_ERR_MD_ALLOC_FAILED );
+        return( MBEDTLS_ERR_MD_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     if( hmac != 0 )
     {
         ctx->hmac_ctx = mbedtls_calloc( 2, md_info->block_size );
         if( ctx->hmac_ctx == NULL )
-        {
+        { // LCOV_EXCL_START
             md_info->ctx_free_func( ctx->md_ctx );
             return( MBEDTLS_ERR_MD_ALLOC_FAILED );
-        }
+        } // LCOV_EXCL_STOP
     }
 
     ctx->md_info = md_info;
@@ -299,12 +299,12 @@ int mbedtls_md_file( const mbedtls_md_info_t *md_info, const char *path, unsigne
         return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
 
     if( ( f = fopen( path, "rb" ) ) == NULL )
-        return( MBEDTLS_ERR_MD_FILE_IO_ERROR );
+        return( MBEDTLS_ERR_MD_FILE_IO_ERROR ); // LCOV_EXCL_LINE
 
     mbedtls_md_init( &ctx );
 
     if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
-        goto cleanup;
+        goto cleanup; // LCOV_EXCL_LINE
 
     md_info->starts_func( ctx.md_ctx );
 
@@ -312,10 +312,10 @@ int mbedtls_md_file( const mbedtls_md_info_t *md_info, const char *path, unsigne
         md_info->update_func( ctx.md_ctx, buf, n );
 
     if( ferror( f ) != 0 )
-    {
+    { // LCOV_EXCL_START
         ret = MBEDTLS_ERR_MD_FILE_IO_ERROR;
         goto cleanup;
-    }
+    } // LCOV_EXCL_STOP
 
     md_info->finish_func( ctx.md_ctx, output );
 
@@ -423,7 +423,7 @@ int mbedtls_md_hmac( const mbedtls_md_info_t *md_info, const unsigned char *key,
     mbedtls_md_init( &ctx );
 
     if( ( ret = mbedtls_md_setup( &ctx, md_info, 1 ) ) != 0 )
-        return( ret );
+        return( ret ); // LCOV_EXCL_LINE (alloc the only possible failure)
 
     mbedtls_md_hmac_starts( &ctx, key, keylen );
     mbedtls_md_hmac_update( &ctx, input, ilen );
diff --git a/library/md2.c b/library/md2.c
index 8976701..298a994 100644
--- a/library/md2.c
+++ b/library/md2.c
@@ -266,12 +266,12 @@ int mbedtls_md2_self_test( int verbose )
              strlen( md2_test_str[i] ), md2sum );
 
         if( memcmp( md2sum, md2_test_sum[i], 16 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/md4.c b/library/md4.c
index 11a77e3..2a2082e 100644
--- a/library/md4.c
+++ b/library/md4.c
@@ -362,12 +362,12 @@ int mbedtls_md4_self_test( int verbose )
              strlen( md4_test_str[i] ), md4sum );
 
         if( memcmp( md4sum, md4_test_sum[i], 16 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/md5.c b/library/md5.c
index 5d972dc..e187791 100644
--- a/library/md5.c
+++ b/library/md5.c
@@ -382,12 +382,12 @@ int mbedtls_md5_self_test( int verbose )
         mbedtls_md5( md5_test_buf[i], md5_test_buflen[i], md5sum );
 
         if( memcmp( md5sum, md5_test_sum[i], 16 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/pem.c b/library/pem.c
index 541e870..57a120a 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -322,7 +322,7 @@ int mbedtls_pem_read_buffer( mbedtls_pem_context *ctx, const char *header, const
         return( MBEDTLS_ERR_PEM_INVALID_DATA + ret );
 
     if( ( buf = mbedtls_calloc( 1, len ) ) == NULL )
-        return( MBEDTLS_ERR_PEM_ALLOC_FAILED );
+        return( MBEDTLS_ERR_PEM_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     if( ( ret = mbedtls_base64_decode( buf, len, &len, s1, s2 - s1 ) ) != 0 )
     {
@@ -408,7 +408,7 @@ int mbedtls_pem_write_buffer( const char *header, const char *footer,
     }
 
     if( ( encode_buf = mbedtls_calloc( 1, use_len ) ) == NULL )
-        return( MBEDTLS_ERR_PEM_ALLOC_FAILED );
+        return( MBEDTLS_ERR_PEM_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     if( ( ret = mbedtls_base64_encode( encode_buf, use_len, &use_len, der_data,
                                der_len ) ) != 0 )
diff --git a/library/pk.c b/library/pk.c
index 10bd0a5..eddcdd7 100644
--- a/library/pk.c
+++ b/library/pk.c
@@ -104,7 +104,7 @@ int mbedtls_pk_setup( mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info )
         return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
 
     if( ( ctx->pk_ctx = info->ctx_alloc_func() ) == NULL )
-        return( MBEDTLS_ERR_PK_ALLOC_FAILED );
+        return( MBEDTLS_ERR_PK_ALLOC_FAILED ); // LCOV_EXCL_LINE;
 
     ctx->pk_info = info;
 
@@ -127,7 +127,7 @@ int mbedtls_pk_setup_rsa_alt( mbedtls_pk_context *ctx, void * key,
         return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
 
     if( ( ctx->pk_ctx = info->ctx_alloc_func() ) == NULL )
-        return( MBEDTLS_ERR_PK_ALLOC_FAILED );
+        return( MBEDTLS_ERR_PK_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     ctx->pk_info = info;
 
diff --git a/library/pkcs5.c b/library/pkcs5.c
index 44af986..b2a02bc 100644
--- a/library/pkcs5.c
+++ b/library/pkcs5.c
@@ -379,13 +379,13 @@ int mbedtls_pkcs5_self_test( int verbose )
                                   slen[i], it_cnt[i], key_len[i], key );
         if( ret != 0 ||
             memcmp( result_key[i], key, key_len[i] ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/pkparse.c b/library/pkparse.c
index bddcf5d..4b1fd5d 100644
--- a/library/pkparse.c
+++ b/library/pkparse.c
@@ -83,27 +83,27 @@ int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n )
 
     fseek( f, 0, SEEK_END );
     if( ( size = ftell( f ) ) == -1 )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
-    }
+    } // LCOV_EXCL_STOP
     fseek( f, 0, SEEK_SET );
 
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
         ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         return( MBEDTLS_ERR_PK_ALLOC_FAILED );
-    }
+    } // LCOV_EXCL_STOP
 
     if( fread( *buf, 1, *n, f ) != *n )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         mbedtls_free( *buf );
         return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     fclose( f );
 
diff --git a/library/ripemd160.c b/library/ripemd160.c
index a55cc3e..fb49cb2 100644
--- a/library/ripemd160.c
+++ b/library/ripemd160.c
@@ -445,12 +445,12 @@ int mbedtls_ripemd160_self_test( int verbose )
                    output );
 
         if( memcmp( output, ripemd160_test_md[i], 20 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/rsa.c b/library/rsa.c
index 3883d09..70c8119 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -1603,12 +1603,12 @@ int mbedtls_rsa_self_test( int verbose )
 
     if( mbedtls_rsa_check_pubkey(  &rsa ) != 0 ||
         mbedtls_rsa_check_privkey( &rsa ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( 1 );
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n  PKCS#1 encryption : " );
@@ -1617,12 +1617,12 @@ int mbedtls_rsa_self_test( int verbose )
 
     if( mbedtls_rsa_pkcs1_encrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PUBLIC, PT_LEN,
                            rsa_plaintext, rsa_ciphertext ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( 1 );
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n  PKCS#1 decryption : " );
@@ -1630,20 +1630,20 @@ int mbedtls_rsa_self_test( int verbose )
     if( mbedtls_rsa_pkcs1_decrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, &len,
                            rsa_ciphertext, rsa_decrypted,
                            sizeof(rsa_decrypted) ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( 1 );
-    }
+    } // LCOV_EXCL_STOP
 
     if( memcmp( rsa_decrypted, rsa_plaintext, len ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( 1 );
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n" );
@@ -1656,24 +1656,24 @@ int mbedtls_rsa_self_test( int verbose )
 
     if( mbedtls_rsa_pkcs1_sign( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA1, 0,
                         sha1sum, rsa_ciphertext ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( 1 );
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n  PKCS#1 sig. verify: " );
 
     if( mbedtls_rsa_pkcs1_verify( &rsa, NULL, NULL, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA1, 0,
                           sha1sum, rsa_ciphertext ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( 1 );
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n" );
diff --git a/library/sha1.c b/library/sha1.c
index 8c77cba..2f2a01c 100644
--- a/library/sha1.c
+++ b/library/sha1.c
@@ -422,13 +422,13 @@ int mbedtls_sha1_self_test( int verbose )
         mbedtls_sha1_finish( &ctx, sha1sum );
 
         if( memcmp( sha1sum, sha1_test_sum[i], 20 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/sha256.c b/library/sha256.c
index 4e82c0b..0432ac8 100644
--- a/library/sha256.c
+++ b/library/sha256.c
@@ -419,13 +419,13 @@ int mbedtls_sha256_self_test( int verbose )
         mbedtls_sha256_finish( &ctx, sha256sum );
 
         if( memcmp( sha256sum, sha256_test_sum[i], 32 - k * 4 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/sha512.c b/library/sha512.c
index af610bb..1b06ea4 100644
--- a/library/sha512.c
+++ b/library/sha512.c
@@ -474,13 +474,13 @@ int mbedtls_sha512_self_test( int verbose )
         mbedtls_sha512_finish( &ctx, sha512sum );
 
         if( memcmp( sha512sum, sha512_test_sum[i], 64 - k * 16 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/library/ssl_cache.c b/library/ssl_cache.c
index 711bc53..6456965 100644
--- a/library/ssl_cache.c
+++ b/library/ssl_cache.c
@@ -104,10 +104,10 @@ int mbedtls_ssl_cache_get( void *data, mbedtls_ssl_session *session )
         {
             if( ( session->peer_cert = mbedtls_calloc( 1,
                                  sizeof(mbedtls_x509_crt) ) ) == NULL )
-            {
+            { // LCOV_EXCL_START
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
 
             mbedtls_x509_crt_init( session->peer_cert );
             if( mbedtls_x509_crt_parse( session->peer_cert, entry->peer_cert.p,
@@ -223,10 +223,10 @@ int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session )
              */
             cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) );
             if( cur == NULL )
-            {
+            { // LCOV_EXCL_START
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
 
             if( prv == NULL )
                 cache->chain = cur;
@@ -258,10 +258,10 @@ int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session )
     {
         cur->peer_cert.p = mbedtls_calloc( 1, session->peer_cert->raw.len );
         if( cur->peer_cert.p == NULL )
-        {
+        { // LCOV_EXCL_START
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         memcpy( cur->peer_cert.p, session->peer_cert->raw.p,
                 session->peer_cert->raw.len );
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index c82e2e7..2451eb3 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -1641,10 +1641,10 @@ static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl )
 
     curve_info = mbedtls_ecp_curve_info_from_grp_id( ssl->handshake->ecdh_ctx.grp.id );
     if( curve_info == NULL )
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
 
@@ -2037,10 +2037,10 @@ static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
           MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
           MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
@@ -2089,10 +2089,10 @@ static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
         }
         else
 #endif
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
         /*
          * Read signature
@@ -2186,10 +2186,10 @@ static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
         else
 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
           MBEDTLS_SSL_PROTO_TLS1_2 */
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
         MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
             (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
@@ -2248,8 +2248,10 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
         return( 0 );
     }
 
+    // LCOV_EXCL_START
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
     return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    // LCOV_EXCL_STOP
 }
 #else
 static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
@@ -2623,10 +2625,10 @@ static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
         }
         else
 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
         if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
                         ciphersuite_info->key_exchange ) ) != 0 )
@@ -2646,11 +2648,11 @@ static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
     }
     else
 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
-    {
+    { // LCOV_EXCL_START
         ((void) ciphersuite_info);
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     ssl->out_msglen  = i + n;
     ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
@@ -2696,8 +2698,10 @@ static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
         return( 0 );
     }
 
+    // LCOV_EXCL_START
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
     return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    // LCOV_EXCL_STOP
 }
 #else
 static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
@@ -2815,10 +2819,10 @@ static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
     }
     else
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash_start, hashlen,
                          ssl->out_msg + 6 + offset, &n,
@@ -2924,10 +2928,10 @@ static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
     ssl->session_negotiate->ticket_len = 0;
 
     if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
         return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
-    }
+    } // LCOV_EXCL_STOP
 
     memcpy( ticket, msg + 6, ticket_len );
 
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index b48a609..6919b1f 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -263,7 +263,7 @@ static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
         our_size = MBEDTLS_ECP_DP_MAX;
 
     if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     ssl->handshake->curves = curves;
 
@@ -2340,8 +2340,10 @@ static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
         return( 0 );
     }
 
+    // LCOV_EXCL_START
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
     return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    // LCOV_EXCL_STOP
 }
 #else
 static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
@@ -2715,10 +2717,10 @@ curve_matching_done:
             md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg );
 
             if( md_alg == MBEDTLS_MD_NONE )
-            {
+            { // LCOV_EXCL_START
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
                 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-            }
+            } // LCOV_EXCL_STOP
         }
         else
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
@@ -2813,10 +2815,10 @@ curve_matching_done:
         else
 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
           MBEDTLS_SSL_PROTO_TLS1_2 */
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
         MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
             (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
@@ -3326,10 +3328,10 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
     }
     else
 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
     {
@@ -3364,8 +3366,10 @@ static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
         return( 0 );
     }
 
+    // LCOV_EXCL_START
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
     return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    // LCOV_EXCL_STOP
 }
 #else
 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
@@ -3489,10 +3493,10 @@ static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
     }
     else
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     if( i + 2 > ssl->in_hslen )
     {
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 9213290..b710eab 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -169,7 +169,7 @@ static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session
 
         dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
         if( dst->peer_cert == NULL )
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
         mbedtls_x509_crt_init( dst->peer_cert );
 
@@ -188,7 +188,7 @@ static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session
     {
         dst->ticket = mbedtls_calloc( 1, src->ticket_len );
         if( dst->ticket == NULL )
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
         memcpy( dst->ticket, src->ticket, src->ticket_len );
     }
@@ -559,10 +559,10 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
     else
 #endif
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     /*
      * SSLv3:
@@ -756,10 +756,10 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
             }
             else
 #endif
-            {
+            { // LCOV_EXCL_START
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
                 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-            }
+            } // LCOV_EXCL_STOP
         }
     }
 
@@ -819,10 +819,10 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
     if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
     {
         if( transform->maclen > sizeof transform->mac_enc )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
         memcpy( transform->mac_enc, mac_enc, transform->maclen );
         memcpy( transform->mac_dec, mac_dec, transform->maclen );
@@ -838,10 +838,10 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
     }
     else
 #endif
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
     if( mbedtls_ssl_hw_record_init != NULL )
@@ -923,11 +923,11 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
             MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
             ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_BUFFER_LEN );
             if( ssl->compress_buf == NULL )
-            {
+            { // LCOV_EXCL_START
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
                                     MBEDTLS_SSL_BUFFER_LEN ) );
                 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
-            }
+            } // LCOV_EXCL_STOP
         }
 
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
@@ -1161,10 +1161,10 @@ int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exch
     }
     else
 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     /* opaque psk<0..2^16-1>; */
     if( end - p < 2 + (int) psk_len )
@@ -1286,10 +1286,10 @@ static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
         }
         else
 #endif
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
         MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac",
                        ssl->out_msg + ssl->out_msglen,
@@ -1318,16 +1318,16 @@ static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
                                    ssl->transform_out->ivlen,
                                    ssl->out_msg, ssl->out_msglen,
                                    ssl->out_msg, &olen ) ) != 0 )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
             return( ret );
-        }
+        } // LCOV_EXCL_STOP
 
         if( ssl->out_msglen != olen )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
     }
     else
 #endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
@@ -1403,16 +1403,16 @@ static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
                                          enc_msg, enc_msglen,
                                          enc_msg, &olen,
                                          enc_msg + enc_msglen, taglen ) ) != 0 )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
             return( ret );
-        }
+        } // LCOV_EXCL_STOP
 
         if( olen != enc_msglen )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
         ssl->out_msglen += taglen;
         auth_done++;
@@ -1479,16 +1479,16 @@ static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
                                    ssl->transform_out->ivlen,
                                    enc_msg, enc_msglen,
                                    enc_msg, &olen ) ) != 0 )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
             return( ret );
-        }
+        } // LCOV_EXCL_STOP
 
         if( enc_msglen != olen )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
         if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
@@ -1539,10 +1539,10 @@ static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
     else
 #endif /* MBEDTLS_CIPHER_MODE_CBC &&
           ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C ) */
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     /* Make extra sure authentication was performed, exactly once */
     if( auth_done != 1 )
@@ -1597,16 +1597,16 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
                                    ssl->transform_in->ivlen,
                                    ssl->in_msg, ssl->in_msglen,
                                    ssl->in_msg, &olen ) ) != 0 )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
             return( ret );
-        }
+        } // LCOV_EXCL_STOP
 
         if( ssl->in_msglen != olen )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
     }
     else
 #endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
@@ -1671,15 +1671,15 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
             if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
                 return( MBEDTLS_ERR_SSL_INVALID_MAC );
 
-            return( ret );
+            return( ret ); // LCOV_EXCL_LINE
         }
         auth_done++;
 
         if( olen != dec_msglen )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
     }
     else
 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
@@ -1791,16 +1791,16 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
                                    ssl->transform_in->ivlen,
                                    dec_msg, dec_msglen,
                                    dec_msg_result, &olen ) ) != 0 )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
             return( ret );
-        }
+        } // LCOV_EXCL_STOP
 
         if( dec_msglen != olen )
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
         if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
@@ -1887,20 +1887,20 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
         else
 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
           MBEDTLS_SSL_PROTO_TLS1_2 */
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
         ssl->in_msglen -= padlen;
     }
     else
 #endif /* MBEDTLS_CIPHER_MODE_CBC &&
           ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C ) */
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
                    ssl->in_msg, ssl->in_msglen );
@@ -1970,10 +1970,10 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
         else
 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
               MBEDTLS_SSL_PROTO_TLS1_2 */
-        {
+        { // LCOV_EXCL_START
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-        }
+        } // LCOV_EXCL_STOP
 
         MBEDTLS_SSL_DEBUG_BUF( 4, "message  mac", tmp, ssl->transform_in->maclen );
         MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", ssl->in_msg + ssl->in_msglen,
@@ -3975,8 +3975,10 @@ int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
         return( 0 );
     }
 
+    // LCOV_EXCL_START
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
     return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    // LCOV_EXCL_STOP
 }
 
 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
@@ -3994,8 +3996,10 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
         return( 0 );
     }
 
+    // LCOV_EXCL_START
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
     return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    // LCOV_EXCL_STOP
 }
 #else
 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
@@ -4246,11 +4250,11 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
 
     if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1,
                     sizeof( mbedtls_x509_crt ) ) ) == NULL )
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
                        sizeof( mbedtls_x509_crt ) ) );
         return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
-    }
+    } // LCOV_EXCL_STOP
 
     mbedtls_x509_crt_init( ssl->session_negotiate->peer_cert );
 
@@ -5201,7 +5205,7 @@ static int ssl_handshake_init( mbedtls_ssl_context *ssl )
     if( ssl->handshake == NULL ||
         ssl->transform_negotiate == NULL ||
         ssl->session_negotiate == NULL )
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
 
         mbedtls_free( ssl->handshake );
@@ -5213,7 +5217,7 @@ static int ssl_handshake_init( mbedtls_ssl_context *ssl )
         ssl->session_negotiate = NULL;
 
         return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
-    }
+    } // LCOV_EXCL_STOP
 
     /* Initialize structures */
     mbedtls_ssl_session_init( ssl->session_negotiate );
@@ -5290,12 +5294,12 @@ int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
      */
     if( ( ssl-> in_buf = mbedtls_calloc( 1, len ) ) == NULL ||
         ( ssl->out_buf = mbedtls_calloc( 1, len ) ) == NULL )
-    {
+    { // LCOV_EXCL_START
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", len ) );
         mbedtls_free( ssl->in_buf );
         ssl->in_buf = NULL;
         return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
-    }
+    } // LCOV_EXCL_STOP
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
@@ -5617,7 +5621,7 @@ static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
 
     new = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
     if( new == NULL )
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     new->cert = cert;
     new->key  = key;
@@ -5708,7 +5712,7 @@ int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
     {
         mbedtls_free( conf->psk );
         conf->psk = NULL;
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); // LCOV_EXCL_LINE
     }
 
     conf->psk_len = psk_len;
@@ -5836,7 +5840,7 @@ int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
     ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
 
     if( ssl->hostname == NULL )
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     memcpy( ssl->hostname, hostname, hostname_len );
 
@@ -6500,10 +6504,10 @@ int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
                 else
 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
           MBEDTLS_SSL_PROTO_TLS1_2 */
-                {
+                { // LCOV_EXCL_START
                     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
                     return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
-                }
+                } // LCOV_EXCL_STOP
             }
             else
             {
diff --git a/library/timing.c b/library/timing.c
index 5d8b25b..c6beff4 100644
--- a/library/timing.c
+++ b/library/timing.c
@@ -416,12 +416,12 @@ int mbedtls_timing_self_test( int verbose )
         /* For some reason on Windows it looks like alarm has an extra delay
          * (maybe related to creating a new thread). Allow some room here. */
         if( millisecs < 800 * secs || millisecs > 1200 * secs + 300 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( verbose != 0 )
@@ -474,12 +474,12 @@ int mbedtls_timing_self_test( int verbose )
 
 hard_test:
     if( hardfail > 1 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed (ignored)\n" );
 
         goto hard_test_done;
-    }
+    } // LCOV_EXCL_STOP
 
     /* Get a reference ratio cycles/ms */
     millisecs = 1;
@@ -498,10 +498,10 @@ hard_test:
         /* Allow variation up to 20% */
         if( cycles / millisecs < ratio - ratio / 5 ||
             cycles / millisecs > ratio + ratio / 5 )
-        {
+        { // LCOV_EXCL_START
             hardfail++;
             goto hard_test;
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( verbose != 0 )
diff --git a/library/x509.c b/library/x509.c
index ffc3d6c..dbb784b 100644
--- a/library/x509.c
+++ b/library/x509.c
@@ -468,7 +468,7 @@ int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end,
         cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
         if( cur->next == NULL )
-            return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+            return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
         cur = cur->next;
     }
@@ -594,7 +594,7 @@ int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x50
 
         pss_opts = mbedtls_calloc( 1, sizeof( mbedtls_pk_rsassa_pss_options ) );
         if( pss_opts == NULL )
-            return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+            return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
         ret = mbedtls_x509_get_rsassa_pss_params( sig_params,
                                           md_alg,
@@ -975,36 +975,36 @@ int mbedtls_x509_self_test( int verbose )
     ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) mbedtls_test_cli_crt,
                            mbedtls_test_cli_crt_len );
     if( ret != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( ret );
-    }
+    } // LCOV_EXCL_STOP
 
     mbedtls_x509_crt_init( &cacert );
 
     ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) mbedtls_test_ca_crt,
                           mbedtls_test_ca_crt_len );
     if( ret != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( ret );
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n  X.509 signature verify: ");
 
     ret = mbedtls_x509_crt_verify( &clicert, &cacert, NULL, NULL, &flags, NULL, NULL );
     if( ret != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         return( ret );
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n\n");
diff --git a/library/x509_create.c b/library/x509_create.c
index 3b773c0..dc0c40a 100644
--- a/library/x509_create.c
+++ b/library/x509_create.c
@@ -131,7 +131,7 @@ int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *na
                                        (unsigned char *) data,
                                        d - data ) == NULL )
             {
-                return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+                return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
             }
 
             while( c < end && *(c + 1) == ' ' )
@@ -171,7 +171,7 @@ int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid,
     if( ( cur = mbedtls_asn1_store_named_data( head, oid, oid_len,
                                        NULL, val_len + 1 ) ) == NULL )
     {
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
     }
 
     cur->val.p[0] = critical;
diff --git a/library/x509_crl.c b/library/x509_crl.c
index 125a773..ed5821e 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -240,7 +240,7 @@ static int x509_get_entries( unsigned char **p,
             cur_entry->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl_entry ) );
 
             if( cur_entry->next == NULL )
-                return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+                return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
             cur_entry = cur_entry->next;
         }
@@ -282,10 +282,10 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
         crl->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) );
 
         if( crl->next == NULL )
-        {
+        { // LCOV_EXCL_START
             mbedtls_x509_crl_free( crl );
             return( MBEDTLS_ERR_X509_ALLOC_FAILED );
-        }
+        } // LCOV_EXCL_STOP
 
         mbedtls_x509_crl_init( crl->next );
         crl = crl->next;
@@ -295,7 +295,7 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
      * Copy raw DER-encoded CRL
      */
     if( ( p = mbedtls_calloc( 1, buflen ) ) == NULL )
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     memcpy( p, buf, buflen );
 
diff --git a/library/x509_crt.c b/library/x509_crt.c
index f6879dd..a828a86 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -489,7 +489,7 @@ static int x509_get_subject_alt_name( unsigned char **p,
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
-                        MBEDTLS_ERR_ASN1_ALLOC_FAILED );
+                        MBEDTLS_ERR_ASN1_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
             cur = cur->next;
         }
@@ -680,7 +680,7 @@ static int x509_crt_parse_der_core( mbedtls_x509_crt *crt, const unsigned char *
 
     p = mbedtls_calloc( 1, len = buflen );
     if( p == NULL )
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     memcpy( p, buf, buflen );
 
@@ -936,7 +936,7 @@ int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, const unsigned char *bu
         crt->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( crt->next == NULL )
-            return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+            return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
         prev = crt;
         mbedtls_x509_crt_init( crt->next );
@@ -1046,7 +1046,7 @@ int mbedtls_x509_crt_parse( mbedtls_x509_crt *chain, const unsigned char *buf, s
                  * Quit parsing on a memory error
                  */
                 if( ret == MBEDTLS_ERR_X509_ALLOC_FAILED )
-                    return( ret );
+                    return( ret ); // LCOV_EXCL_LINE
 
                 if( first_error == 0 )
                     first_error = ret;
diff --git a/library/x509_csr.c b/library/x509_csr.c
index dbf659b..bdc51a9 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -115,7 +115,7 @@ int mbedtls_x509_csr_parse_der( mbedtls_x509_csr *csr,
     p = mbedtls_calloc( 1, len = buflen );
 
     if( p == NULL )
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     memcpy( p, buf, buflen );
 
diff --git a/library/xtea.c b/library/xtea.c
index fe0a350..3b718ce 100644
--- a/library/xtea.c
+++ b/library/xtea.c
@@ -255,13 +255,13 @@ int mbedtls_xtea_self_test( int verbose )
         mbedtls_xtea_crypt_ecb( &ctx, MBEDTLS_XTEA_ENCRYPT, buf, buf );
 
         if( memcmp( buf, xtea_test_ct[i], 8 ) != 0 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
diff --git a/scripts/data_files/error.fmt b/scripts/data_files/error.fmt
index bd6ef01..5d6f795 100644
--- a/scripts/data_files/error.fmt
+++ b/scripts/data_files/error.fmt
@@ -62,7 +62,9 @@ void mbedtls_strerror( int ret, char *buf, size_t buflen )
         // High level error codes
         //
         // BEGIN generated code
+        // LCOV_EXCL_START
 HIGH_LEVEL_CODE_CHECKS
+        // LCOV_EXCL_STOP
         // END generated code
 
         if( strlen( buf ) == 0 )
@@ -93,7 +95,9 @@ HIGH_LEVEL_CODE_CHECKS
     // Low level error codes
     //
     // BEGIN generated code
+    // LCOV_EXCL_START
 LOW_LEVEL_CODE_CHECKS
+    // LCOV_EXCL_STOP
     // END generated code
 
     if( strlen( buf ) != 0 )