crypto/evp/digest.c:397: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_copy_ex()` eventually accesses memory that was invalidated by call to `free()` on line 396 indirectly during the call to `EVP_MD_CTX_reset()`.
Showing all 14 steps of the trace


crypto/evp/digest.c:394:1: invalidation part of the trace starts here
392.   }
393.   
394. > int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
395.   {
396.       EVP_MD_CTX_reset(out);

crypto/evp/digest.c:394:1: parameter `out` of EVP_MD_CTX_copy
  392.   }
  393.   
  394. > int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
  395.   {
  396.       EVP_MD_CTX_reset(out);

crypto/evp/digest.c:396:5: when calling `EVP_MD_CTX_reset` here
  394.   int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
  395.   {
  396.       EVP_MD_CTX_reset(out);
             ^
  397.       return EVP_MD_CTX_copy_ex(out, in);
  398.   }

crypto/evp/digest.c:22:1: parameter `ctx` of EVP_MD_CTX_reset
    20.   
    21.   /* This call frees resources associated with the context */
    22. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
    23.   {
    24.       if (ctx == NULL)

crypto/evp/digest.c:54:9: when calling `CRYPTO_clear_free` here
    52.       if (ctx->digest && ctx->digest->ctx_size && ctx->md_data
    53.           && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {
    54.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
                  ^
    55.       }
    56.       /*

crypto/mem.c:316:1: parameter `str` of CRYPTO_clear_free
      314.   }
      315.   
      316. > void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)
      317.   {
      318.       if (str == NULL)

crypto/mem.c:322:5: when calling `CRYPTO_free` here
      320.       if (num)
      321.           OPENSSL_cleanse(str, num);
      322.       CRYPTO_free(str, file, line);
                 ^
      323.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
        293.   }
        294.   
        295. > void CRYPTO_free(void *str, const char *file, int line)
        296.   {
        297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
        310.       }
        311.   #else
        312.       free(str);
                   ^
        313.   #endif
        314.   }

crypto/evp/digest.c:394:1: use-after-lifetime part of the trace starts here
392.   }
393.   
394. > int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
395.   {
396.       EVP_MD_CTX_reset(out);

crypto/evp/digest.c:394:1: parameter `out` of EVP_MD_CTX_copy
  392.   }
  393.   
  394. > int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
  395.   {
  396.       EVP_MD_CTX_reset(out);

crypto/evp/digest.c:397:12: when calling `EVP_MD_CTX_copy_ex` here
  395.   {
  396.       EVP_MD_CTX_reset(out);
  397.       return EVP_MD_CTX_copy_ex(out, in);
                    ^
  398.   }
  399.   

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)\n{\n    EVP_MD_CTX_reset(out);\n    return EVP_MD_CTX_copy_ex(out, in);\n}', 'int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)\n{\n    if (ctx == NULL)\n        return 1;\n    if (ctx->digest == NULL || ctx->digest->prov == NULL)\n        goto legacy;\n    if (ctx->provctx != NULL) {\n        if (ctx->digest->freectx != NULL)\n            ctx->digest->freectx(ctx->provctx);\n        ctx->provctx = NULL;\n        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_CLEANED);\n    }\n    if (ctx->pctx != NULL)\n        goto legacy;\n    return 1;\n legacy:\n    if (ctx->digest && ctx->digest->cleanup\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_CLEANED))\n        ctx->digest->cleanup(ctx);\n    if (ctx->digest && ctx->digest->ctx_size && ctx->md_data\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {\n        OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);\n    }\n#ifndef FIPS_MODE\n    if (!EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX))\n        EVP_PKEY_CTX_free(ctx->pctx);\n# ifndef OPENSSL_NO_ENGINE\n    ENGINE_finish(ctx->engine);\n# endif\n#endif\n    OPENSSL_cleanse(ctx, sizeof(*ctx));\n    return 1;\n}', 'void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)\n{\n    if (str == NULL)\n        return;\n    if (num)\n        OPENSSL_cleanse(str, num);\n    CRYPTO_free(str, file, line);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']