crypto/hmac/hmac.c:232: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_copy_ex()` eventually accesses memory that was invalidated by call to `free()` on line 230 indirectly during the call to `HMAC_CTX_reset()`.
Showing all 18 steps of the trace


crypto/hmac/hmac.c:228:1: invalidation part of the trace starts here
226.   }
227.   
228. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
229.   {
230.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:228:1: parameter `dctx` of HMAC_CTX_copy
  226.   }
  227.   
  228. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
  229.   {
  230.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:230:10: when calling `HMAC_CTX_reset` here
  228.   int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
  229.   {
  230.       if (!HMAC_CTX_reset(dctx))
                  ^
  231.           goto err;
  232.       if (!EVP_MD_CTX_copy_ex(dctx->i_ctx, sctx->i_ctx))

crypto/hmac/hmac.c:206:1: parameter `ctx` of HMAC_CTX_reset
    204.   }
    205.   
    206. > int HMAC_CTX_reset(HMAC_CTX *ctx)
    207.   {
    208.       hmac_ctx_cleanup(ctx);

crypto/hmac/hmac.c:208:5: when calling `hmac_ctx_cleanup` here
    206.   int HMAC_CTX_reset(HMAC_CTX *ctx)
    207.   {
    208.       hmac_ctx_cleanup(ctx);
               ^
    209.       if (ctx->i_ctx == NULL)
    210.           ctx->i_ctx = EVP_MD_CTX_new();

crypto/hmac/hmac.c:185:1: parameter `ctx` of hmac_ctx_cleanup
      183.   }
      184.   
      185. > static void hmac_ctx_cleanup(HMAC_CTX *ctx)
      186.   {
      187.       EVP_MD_CTX_reset(ctx->i_ctx);

crypto/hmac/hmac.c:187:5: when calling `EVP_MD_CTX_reset` here
      185.   static void hmac_ctx_cleanup(HMAC_CTX *ctx)
      186.   {
      187.       EVP_MD_CTX_reset(ctx->i_ctx);
                 ^
      188.       EVP_MD_CTX_reset(ctx->o_ctx);
      189.       EVP_MD_CTX_reset(ctx->md_ctx);

crypto/evp/digest.c:122:1: parameter `ctx` of EVP_MD_CTX_reset
        120.   
        121.   /* This call frees resources associated with the context */
        122. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
        123.   {
        124.       if (ctx == NULL)

crypto/evp/digest.c:136:9: when calling `CRYPTO_clear_free` here
        134.       if (ctx->digest && ctx->digest->ctx_size && ctx->md_data
        135.           && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {
        136.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
                       ^
        137.       }
        138.       EVP_PKEY_CTX_free(ctx->pctx);

crypto/mem.c:248:1: parameter `str` of CRYPTO_clear_free
          246.   }
          247.   
          248. > void CRYPTO_clear_free(void *str, size_t num)
          249.   {
          250.       if (str == NULL)

crypto/mem.c:254:5: when calling `CRYPTO_free` here
          252.       if (num)
          253.           OPENSSL_cleanse(str, num);
          254.       CRYPTO_free(str);
                     ^
          255.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
            231.   }
            232.   
            233. > void CRYPTO_free(void *str)
            234.   {
            235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
            242.       }
            243.   #else
            244.       free(str);
                       ^
            245.   #endif
            246.   }

crypto/hmac/hmac.c:228:1: use-after-lifetime part of the trace starts here
226.   }
227.   
228. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
229.   {
230.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:228:1: parameter `dctx` of HMAC_CTX_copy
  226.   }
  227.   
  228. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
  229.   {
  230.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:232:10: when calling `EVP_MD_CTX_copy_ex` here
  230.       if (!HMAC_CTX_reset(dctx))
  231.           goto err;
  232.       if (!EVP_MD_CTX_copy_ex(dctx->i_ctx, sctx->i_ctx))
                  ^
  233.           goto err;
  234.       if (!EVP_MD_CTX_copy_ex(dctx->o_ctx, sctx->o_ctx))

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }

void CRYPTO_free(void *str)
{
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0);
        free(str);
        CRYPTO_mem_debug_free(str, 1);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)\n{\n    if (!HMAC_CTX_reset(dctx))\n        goto err;\n    if (!EVP_MD_CTX_copy_ex(dctx->i_ctx, sctx->i_ctx))\n        goto err;\n    if (!EVP_MD_CTX_copy_ex(dctx->o_ctx, sctx->o_ctx))\n        goto err;\n    if (!EVP_MD_CTX_copy_ex(dctx->md_ctx, sctx->md_ctx))\n        goto err;\n    memcpy(dctx->key, sctx->key, HMAC_MAX_MD_CBLOCK);\n    dctx->key_length = sctx->key_length;\n    dctx->md = sctx->md;\n    return 1;\n err:\n    hmac_ctx_cleanup(dctx);\n    return 0;\n}', 'int HMAC_CTX_reset(HMAC_CTX *ctx)\n{\n    hmac_ctx_cleanup(ctx);\n    if (ctx->i_ctx == NULL)\n        ctx->i_ctx = EVP_MD_CTX_new();\n    if (ctx->i_ctx == NULL)\n        goto err;\n    if (ctx->o_ctx == NULL)\n        ctx->o_ctx = EVP_MD_CTX_new();\n    if (ctx->o_ctx == NULL)\n        goto err;\n    if (ctx->md_ctx == NULL)\n        ctx->md_ctx = EVP_MD_CTX_new();\n    if (ctx->md_ctx == NULL)\n        goto err;\n    ctx->md = NULL;\n    return 1;\n err:\n    hmac_ctx_cleanup(ctx);\n    return 0;\n}', 'static void hmac_ctx_cleanup(HMAC_CTX *ctx)\n{\n    EVP_MD_CTX_reset(ctx->i_ctx);\n    EVP_MD_CTX_reset(ctx->o_ctx);\n    EVP_MD_CTX_reset(ctx->md_ctx);\n    ctx->md = NULL;\n    ctx->key_length = 0;\n    memset(ctx->key, 0, sizeof(HMAC_MAX_MD_CBLOCK));\n}', 'int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)\n{\n    if (ctx == NULL)\n        return 1;\n    if (ctx->digest && ctx->digest->cleanup\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_CLEANED))\n        ctx->digest->cleanup(ctx);\n    if (ctx->digest && ctx->digest->ctx_size && ctx->md_data\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {\n        OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);\n    }\n    EVP_PKEY_CTX_free(ctx->pctx);\n#ifndef OPENSSL_NO_ENGINE\n    if (ctx->engine)\n        ENGINE_finish(ctx->engine);\n#endif\n    memset(ctx, 0, sizeof(*ctx));\n    return 1;\n}', 'void CRYPTO_clear_free(void *str, size_t num)\n{\n    if (str == NULL)\n        return;\n    if (num)\n        OPENSSL_cleanse(str, num);\n    CRYPTO_free(str);\n}', 'void CRYPTO_free(void *str)\n{\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']