ssl/t1_enc.c:398: error: USE_AFTER_FREE
  call to `EVP_CipherInit_ex()` eventually accesses memory that was invalidated by call to `free()` on line 249 indirectly during the call to `EVP_CIPHER_CTX_reset()`.
Showing all 16 steps of the trace


ssl/t1_enc.c:243:37: invalidation part of the trace starts here
241.           if (s->enc_read_ctx != NULL)
242.               reuse_dd = 1;
243.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                           ^
244.               goto err;
245.           else

ssl/t1_enc.c:243:37: passed as argument to `EVP_CIPHER_CTX_new`
  241.           if (s->enc_read_ctx != NULL)
  242.               reuse_dd = 1;
  243.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  244.               goto err;
  245.           else

ssl/t1_enc.c:243:37: return from call to `EVP_CIPHER_CTX_new`
  241.           if (s->enc_read_ctx != NULL)
  242.               reuse_dd = 1;
  243.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  244.               goto err;
  245.           else

ssl/t1_enc.c:243:19: assigned
  241.           if (s->enc_read_ctx != NULL)
  242.               reuse_dd = 1;
  243.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                           ^
  244.               goto err;
  245.           else

ssl/t1_enc.c:249:13: when calling `EVP_CIPHER_CTX_reset` here
  247.                * make sure it's intialized in case we exit later with an error
  248.                */
  249.               EVP_CIPHER_CTX_reset(s->enc_read_ctx);
                     ^
  250.           dd = s->enc_read_ctx;
  251.           mac_ctx = ssl_replace_hash(&s->read_hash, NULL);

crypto/evp/evp_enc.c:70:1: parameter `c` of EVP_CIPHER_CTX_reset
    68.   #include "evp_locl.h"
    69.   
    70. > int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
    71.   {
    72.       if (c == NULL)

crypto/evp/evp_enc.c:81:5: when calling `CRYPTO_free` here
    79.               OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);
    80.       }
    81.       OPENSSL_free(c->cipher_data);
              ^
    82.   #ifndef OPENSSL_NO_ENGINE
    83.       if (c->engine)

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
      232.   }
      233.   
      234. > void CRYPTO_free(void *str)
      235.   {
      236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: was invalidated by call to `free()`
      243.       }
      244.   #else
      245.       free(str);
                 ^
      246.   #endif
      247.   }

ssl/t1_enc.c:243:37: use-after-lifetime part of the trace starts here
241.           if (s->enc_read_ctx != NULL)
242.               reuse_dd = 1;
243.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                           ^
244.               goto err;
245.           else

ssl/t1_enc.c:243:37: passed as argument to `EVP_CIPHER_CTX_new`
  241.           if (s->enc_read_ctx != NULL)
  242.               reuse_dd = 1;
  243.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  244.               goto err;
  245.           else

ssl/t1_enc.c:243:37: return from call to `EVP_CIPHER_CTX_new`
  241.           if (s->enc_read_ctx != NULL)
  242.               reuse_dd = 1;
  243.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  244.               goto err;
  245.           else

ssl/t1_enc.c:243:19: assigned
  241.           if (s->enc_read_ctx != NULL)
  242.               reuse_dd = 1;
  243.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                           ^
  244.               goto err;
  245.           else

ssl/t1_enc.c:398:14: when calling `EVP_CipherInit_ex` here
  396.           }
  397.       } else {
  398.           if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) {
                      ^
  399.               SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
  400.               goto err2;

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
    232.   }
    233.   
    234. > void CRYPTO_free(void *str)
    235.   {
    236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: invalid access occurs here
    243.       }
    244.   #else
    245.       free(str);
               ^
    246.   #endif
    247.   }

void CRYPTO_free(void *str)
{
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0);
        free(str);
        CRYPTO_mem_debug_free(str, 1);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['int tls1_change_cipher_state(SSL *s, int which)\n{\n    unsigned char *p, *mac_secret;\n    unsigned char tmp1[EVP_MAX_KEY_LENGTH];\n    unsigned char tmp2[EVP_MAX_KEY_LENGTH];\n    unsigned char iv1[EVP_MAX_IV_LENGTH * 2];\n    unsigned char iv2[EVP_MAX_IV_LENGTH * 2];\n    unsigned char *ms, *key, *iv;\n    EVP_CIPHER_CTX *dd;\n    const EVP_CIPHER *c;\n#ifndef OPENSSL_NO_COMP\n    const SSL_COMP *comp;\n#endif\n    const EVP_MD *m;\n    int mac_type;\n    int *mac_secret_size;\n    EVP_MD_CTX *mac_ctx;\n    EVP_PKEY *mac_key;\n    int n, i, j, k, cl;\n    int reuse_dd = 0;\n    c = s->s3->tmp.new_sym_enc;\n    m = s->s3->tmp.new_hash;\n    mac_type = s->s3->tmp.new_mac_pkey_type;\n#ifndef OPENSSL_NO_COMP\n    comp = s->s3->tmp.new_compression;\n#endif\n    if (which & SSL3_CC_READ) {\n        if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)\n            s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM;\n        else\n            s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM;\n        if (s->enc_read_ctx != NULL)\n            reuse_dd = 1;\n        else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)\n            goto err;\n        else\n            EVP_CIPHER_CTX_reset(s->enc_read_ctx);\n        dd = s->enc_read_ctx;\n        mac_ctx = ssl_replace_hash(&s->read_hash, NULL);\n        if (mac_ctx == NULL)\n            goto err;\n#ifndef OPENSSL_NO_COMP\n        COMP_CTX_free(s->expand);\n        s->expand = NULL;\n        if (comp != NULL) {\n            s->expand = COMP_CTX_new(comp->method);\n            if (s->expand == NULL) {\n                SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,\n                       SSL_R_COMPRESSION_LIBRARY_ERROR);\n                goto err2;\n            }\n            if (!RECORD_LAYER_setup_comp_buffer(&s->rlayer))\n                goto err;\n        }\n#endif\n        if (!SSL_IS_DTLS(s))\n            RECORD_LAYER_reset_read_sequence(&s->rlayer);\n        mac_secret = &(s->s3->read_mac_secret[0]);\n        mac_secret_size = &(s->s3->read_mac_secret_size);\n    } else {\n        if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)\n            s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;\n        else\n            s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;\n        if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s))\n            reuse_dd = 1;\n        else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)\n            goto err;\n        dd = s->enc_write_ctx;\n        if (SSL_IS_DTLS(s)) {\n            mac_ctx = EVP_MD_CTX_new();\n            if (mac_ctx == NULL)\n                goto err;\n            s->write_hash = mac_ctx;\n        } else {\n            mac_ctx = ssl_replace_hash(&s->write_hash, NULL);\n            if (mac_ctx == NULL)\n                goto err;\n        }\n#ifndef OPENSSL_NO_COMP\n        COMP_CTX_free(s->compress);\n        s->compress = NULL;\n        if (comp != NULL) {\n            s->compress = COMP_CTX_new(comp->method);\n            if (s->compress == NULL) {\n                SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,\n                       SSL_R_COMPRESSION_LIBRARY_ERROR);\n                goto err2;\n            }\n        }\n#endif\n        if (!SSL_IS_DTLS(s))\n            RECORD_LAYER_reset_write_sequence(&s->rlayer);\n        mac_secret = &(s->s3->write_mac_secret[0]);\n        mac_secret_size = &(s->s3->write_mac_secret_size);\n    }\n    if (reuse_dd)\n        EVP_CIPHER_CTX_reset(dd);\n    p = s->s3->tmp.key_block;\n    i = *mac_secret_size = s->s3->tmp.new_mac_secret_size;\n    cl = EVP_CIPHER_key_length(c);\n    j = cl;\n    if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)\n        k = EVP_GCM_TLS_FIXED_IV_LEN;\n    else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE)\n        k = EVP_CCM_TLS_FIXED_IV_LEN;\n    else\n        k = EVP_CIPHER_iv_length(c);\n    if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||\n        (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {\n        ms = &(p[0]);\n        n = i + i;\n        key = &(p[n]);\n        n += j + j;\n        iv = &(p[n]);\n        n += k + k;\n    } else {\n        n = i;\n        ms = &(p[n]);\n        n += i + j;\n        key = &(p[n]);\n        n += j + k;\n        iv = &(p[n]);\n        n += k;\n    }\n    if (n > s->s3->tmp.key_block_length) {\n        SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n        goto err2;\n    }\n    memcpy(mac_secret, ms, i);\n    if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) {\n        mac_key = EVP_PKEY_new_mac_key(mac_type, NULL,\n                                       mac_secret, *mac_secret_size);\n        if (mac_key == NULL\n                || EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key) <= 0) {\n            EVP_PKEY_free(mac_key);\n            SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n            goto err2;\n        }\n        EVP_PKEY_free(mac_key);\n    }\n#ifdef TLS_DEBUG\n    printf("which = %04X\\nmac key=", which);\n    {\n        int z;\n        for (z = 0; z < i; z++)\n            printf("%02X%c", ms[z], ((z + 1) % 16) ? \' \' : \'\\n\');\n    }\n#endif\n    if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) {\n        if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE))\n            || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, k, iv)) {\n            SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n            goto err2;\n        }\n    } else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) {\n        int taglen;\n        if (s->s3->tmp.new_cipher->algorithm_enc & (SSL_AES128CCM8|SSL_AES256CCM8))\n            taglen = 8;\n        else\n            taglen = 16;\n        if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE))\n            || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL)\n            || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL)\n            || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, k, iv)\n            || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) {\n            SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n            goto err2;\n        }\n    } else {\n        if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) {\n            SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n            goto err2;\n        }\n    }\n    if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size\n        && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY,\n                                *mac_secret_size, mac_secret)) {\n        SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n        goto err2;\n    }\n#ifdef OPENSSL_SSL_TRACE_CRYPTO\n    if (s->msg_callback) {\n        int wh = which & SSL3_CC_WRITE ? TLS1_RT_CRYPTO_WRITE : 0;\n        if (*mac_secret_size)\n            s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_MAC,\n                            mac_secret, *mac_secret_size,\n                            s, s->msg_callback_arg);\n        if (c->key_len)\n            s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_KEY,\n                            key, c->key_len, s, s->msg_callback_arg);\n        if (k) {\n            if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)\n                wh |= TLS1_RT_CRYPTO_FIXED_IV;\n            else\n                wh |= TLS1_RT_CRYPTO_IV;\n            s->msg_callback(2, s->version, wh, iv, k, s, s->msg_callback_arg);\n        }\n    }\n#endif\n#ifdef TLS_DEBUG\n    printf("which = %04X\\nkey=", which);\n    {\n        int z;\n        for (z = 0; z < EVP_CIPHER_key_length(c); z++)\n            printf("%02X%c", key[z], ((z + 1) % 16) ? \' \' : \'\\n\');\n    }\n    printf("\\niv=");\n    {\n        int z;\n        for (z = 0; z < k; z++)\n            printf("%02X%c", iv[z], ((z + 1) % 16) ? \' \' : \'\\n\');\n    }\n    printf("\\n");\n#endif\n    OPENSSL_cleanse(tmp1, sizeof(tmp1));\n    OPENSSL_cleanse(tmp2, sizeof(tmp1));\n    OPENSSL_cleanse(iv1, sizeof(iv1));\n    OPENSSL_cleanse(iv2, sizeof(iv2));\n    return (1);\n err:\n    SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);\n err2:\n    OPENSSL_cleanse(tmp1, sizeof(tmp1));\n    OPENSSL_cleanse(tmp2, sizeof(tmp1));\n    OPENSSL_cleanse(iv1, sizeof(iv1));\n    OPENSSL_cleanse(iv2, sizeof(iv2));\n    return (0);\n}', 'int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)\n{\n    if (c == NULL)\n        return 1;\n    if (c->cipher != NULL) {\n        if (c->cipher->cleanup && !c->cipher->cleanup(c))\n            return 0;\n        if (c->cipher_data && c->cipher->ctx_size)\n            OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);\n    }\n    OPENSSL_free(c->cipher_data);\n#ifndef OPENSSL_NO_ENGINE\n    if (c->engine)\n        ENGINE_finish(c->engine);\n#endif\n    memset(c, 0, sizeof(*c));\n    return 1;\n}', 'void CRYPTO_free(void *str)\n{\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']