crypto/evp/pkey_mac.c:114: error: USE_AFTER_FREE
  call to `pkey_mac_cleanup()` eventually accesses memory that was invalidated by call to `free()` on line 102 indirectly during the call to `ASN1_STRING_copy()`.
Showing all 29 steps of the trace


crypto/evp/pkey_mac.c:83:12: invalidation part of the trace starts here
81.           return 0;
82.   
83.       dctx = OPENSSL_zalloc(sizeof(*dctx));
                 ^
84.       if (dctx == NULL) {
85.           EVPerr(EVP_F_PKEY_MAC_COPY, ERR_R_MALLOC_FAILURE);

crypto/evp/pkey_mac.c:83:12: passed as argument to `CRYPTO_zalloc`
  81.           return 0;
  82.   
  83.       dctx = OPENSSL_zalloc(sizeof(*dctx));
                   ^
  84.       if (dctx == NULL) {
  85.           EVPerr(EVP_F_PKEY_MAC_COPY, ERR_R_MALLOC_FAILURE);

crypto/evp/pkey_mac.c:83:12: return from call to `CRYPTO_zalloc`
  81.           return 0;
  82.   
  83.       dctx = OPENSSL_zalloc(sizeof(*dctx));
                   ^
  84.       if (dctx == NULL) {
  85.           EVPerr(EVP_F_PKEY_MAC_COPY, ERR_R_MALLOC_FAILURE);

crypto/evp/pkey_mac.c:83:5: assigned
  81.           return 0;
  82.   
  83.       dctx = OPENSSL_zalloc(sizeof(*dctx));
            ^
  84.       if (dctx == NULL) {
  85.           EVPerr(EVP_F_PKEY_MAC_COPY, ERR_R_MALLOC_FAILURE);

crypto/evp/pkey_mac.c:102:14: when calling `ASN1_STRING_copy` here
  100.           dctx->raw_data.md = sctx->raw_data.md;
  101.           if (ASN1_STRING_get0_data(&sctx->raw_data.ktmp) != NULL &&
  102.               !ASN1_STRING_copy(&dctx->raw_data.ktmp, &sctx->raw_data.ktmp))
                      ^
  103.               goto err;
  104.           break;

crypto/asn1/asn1_lib.c:243:1: parameter `dst` of ASN1_STRING_copy
    241.   }
    242.   
    243. > int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str)
    244.   {
    245.       if (str == NULL)

crypto/asn1/asn1_lib.c:248:10: when calling `ASN1_STRING_set` here
    246.           return 0;
    247.       dst->type = str->type;
    248.       if (!ASN1_STRING_set(dst, str->data, str->length))
                    ^
    249.           return 0;
    250.       /* Copy flags but preserve embed value */

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
      269.   }
      270.   
      271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
      272.   {
      273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
      281.       }
      282.       if ((str->length <= len) || (str->data == NULL)) {
      283.           c = str->data;
                     ^
      284.           str->data = OPENSSL_realloc(c, len + 1);
      285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:284:21: when calling `CRYPTO_realloc` here
      282.       if ((str->length <= len) || (str->data == NULL)) {
      283.           c = str->data;
      284.           str->data = OPENSSL_realloc(c, len + 1);
                                 ^
      285.           if (str->data == NULL) {
      286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
        236.   }
        237.   
        238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
        239.   {
        240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
        247.   
        248.       if (num == 0) {
        249.           CRYPTO_free(str, file, line);
                       ^
        250.           return NULL;
        251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
          293.   }
          294.   
          295. > void CRYPTO_free(void *str, const char *file, int line)
          296.   {
          297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
          310.       }
          311.   #else
          312.       free(str);
                     ^
          313.   #endif
          314.   }

crypto/evp/pkey_mac.c:83:12: use-after-lifetime part of the trace starts here
81.           return 0;
82.   
83.       dctx = OPENSSL_zalloc(sizeof(*dctx));
                 ^
84.       if (dctx == NULL) {
85.           EVPerr(EVP_F_PKEY_MAC_COPY, ERR_R_MALLOC_FAILURE);

crypto/evp/pkey_mac.c:83:12: passed as argument to `CRYPTO_zalloc`
  81.           return 0;
  82.   
  83.       dctx = OPENSSL_zalloc(sizeof(*dctx));
                   ^
  84.       if (dctx == NULL) {
  85.           EVPerr(EVP_F_PKEY_MAC_COPY, ERR_R_MALLOC_FAILURE);

crypto/evp/pkey_mac.c:83:12: return from call to `CRYPTO_zalloc`
  81.           return 0;
  82.   
  83.       dctx = OPENSSL_zalloc(sizeof(*dctx));
                   ^
  84.       if (dctx == NULL) {
  85.           EVPerr(EVP_F_PKEY_MAC_COPY, ERR_R_MALLOC_FAILURE);

crypto/evp/pkey_mac.c:83:5: assigned
  81.           return 0;
  82.   
  83.       dctx = OPENSSL_zalloc(sizeof(*dctx));
            ^
  84.       if (dctx == NULL) {
  85.           EVPerr(EVP_F_PKEY_MAC_COPY, ERR_R_MALLOC_FAILURE);

crypto/evp/pkey_mac.c:102:14: passed as argument to `ASN1_STRING_copy`
  100.           dctx->raw_data.md = sctx->raw_data.md;
  101.           if (ASN1_STRING_get0_data(&sctx->raw_data.ktmp) != NULL &&
  102.               !ASN1_STRING_copy(&dctx->raw_data.ktmp, &sctx->raw_data.ktmp))
                      ^
  103.               goto err;
  104.           break;

crypto/asn1/asn1_lib.c:243:1: parameter `dst` of ASN1_STRING_copy
    241.   }
    242.   
    243. > int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str)
    244.   {
    245.       if (str == NULL)

crypto/asn1/asn1_lib.c:248:10: passed as argument to `ASN1_STRING_set`
    246.           return 0;
    247.       dst->type = str->type;
    248.       if (!ASN1_STRING_set(dst, str->data, str->length))
                    ^
    249.           return 0;
    250.       /* Copy flags but preserve embed value */

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
      269.   }
      270.   
      271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
      272.   {
      273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
      281.       }
      282.       if ((str->length <= len) || (str->data == NULL)) {
      283.           c = str->data;
                     ^
      284.           str->data = OPENSSL_realloc(c, len + 1);
      285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:287:13: assigned
      285.           if (str->data == NULL) {
      286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
      287.               str->data = c;
                         ^
      288.               return 0;
      289.           }

crypto/asn1/asn1_lib.c:248:10: return from call to `ASN1_STRING_set`
    246.           return 0;
    247.       dst->type = str->type;
    248.       if (!ASN1_STRING_set(dst, str->data, str->length))
                    ^
    249.           return 0;
    250.       /* Copy flags but preserve embed value */

crypto/evp/pkey_mac.c:102:14: return from call to `ASN1_STRING_copy`
  100.           dctx->raw_data.md = sctx->raw_data.md;
  101.           if (ASN1_STRING_get0_data(&sctx->raw_data.ktmp) != NULL &&
  102.               !ASN1_STRING_copy(&dctx->raw_data.ktmp, &sctx->raw_data.ktmp))
                      ^
  103.               goto err;
  104.           break;

crypto/evp/pkey_mac.c:114:5: when calling `pkey_mac_cleanup` here
  112.       return 1;
  113.    err:
  114.       pkey_mac_cleanup(dst);
             ^
  115.       return 0;
  116.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int pkey_mac_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src)\n{\n    MAC_PKEY_CTX *sctx, *dctx;\n    sctx = EVP_PKEY_CTX_get_data(src);\n    if (sctx->ctx->data == NULL)\n        return 0;\n    dctx = OPENSSL_zalloc(sizeof(*dctx));\n    if (dctx == NULL) {\n        EVPerr(EVP_F_PKEY_MAC_COPY, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    EVP_PKEY_CTX_set_data(dst, dctx);\n    dst->keygen_info_count = 0;\n    dctx->ctx = EVP_MAC_CTX_dup(sctx->ctx);\n    if (dctx->ctx == NULL)\n        goto err;\n    dctx->type = sctx->type;\n    switch (dctx->type) {\n    case MAC_TYPE_RAW:\n        dctx->raw_data.md = sctx->raw_data.md;\n        if (ASN1_STRING_get0_data(&sctx->raw_data.ktmp) != NULL &&\n            !ASN1_STRING_copy(&dctx->raw_data.ktmp, &sctx->raw_data.ktmp))\n            goto err;\n        break;\n    case MAC_TYPE_MAC:\n        break;\n    default:\n        return 0;\n    }\n    return 1;\n err:\n    pkey_mac_cleanup(dst);\n    return 0;\n}', 'int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str)\n{\n    if (str == NULL)\n        return 0;\n    dst->type = str->type;\n    if (!ASN1_STRING_set(dst, str->data, str->length))\n        return 0;\n    dst->flags &= ASN1_STRING_FLAG_EMBED;\n    dst->flags |= str->flags & ~ASN1_STRING_FLAG_EMBED;\n    return 1;\n}', "int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)\n{\n    unsigned char *c;\n    const char *data = _data;\n    if (len < 0) {\n        if (data == NULL)\n            return 0;\n        else\n            len = strlen(data);\n    }\n    if ((str->length <= len) || (str->data == NULL)) {\n        c = str->data;\n        str->data = OPENSSL_realloc(c, len + 1);\n        if (str->data == NULL) {\n            ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);\n            str->data = c;\n            return 0;\n        }\n    }\n    str->length = len;\n    if (data != NULL) {\n        memcpy(str->data, data, len);\n        str->data[len] = '\\0';\n    }\n    return 1;\n}", 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    INCREMENT(realloc_count);\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']