crypto/cmac/cmac.c:83: error: USE_AFTER_FREE
  call to `EVP_CIPHER_CTX_free()` eventually accesses memory that was invalidated by call to `free()` on line 82 indirectly during the call to `CMAC_CTX_cleanup()`.
Showing all 14 steps of the trace


crypto/cmac/cmac.c:78:1: invalidation part of the trace starts here
76.   }
77.   
78. > void CMAC_CTX_free(CMAC_CTX *ctx)
79.   {
80.       if (!ctx)

crypto/cmac/cmac.c:78:1: parameter `ctx` of CMAC_CTX_free
  76.   }
  77.   
  78. > void CMAC_CTX_free(CMAC_CTX *ctx)
  79.   {
  80.       if (!ctx)

crypto/cmac/cmac.c:82:5: when calling `CMAC_CTX_cleanup` here
  80.       if (!ctx)
  81.           return;
  82.       CMAC_CTX_cleanup(ctx);
            ^
  83.       EVP_CIPHER_CTX_free(ctx->cctx);
  84.       OPENSSL_free(ctx);

crypto/cmac/cmac.c:63:1: parameter `ctx` of CMAC_CTX_cleanup
    61.   }
    62.   
    63. > void CMAC_CTX_cleanup(CMAC_CTX *ctx)
    64.   {
    65.       EVP_CIPHER_CTX_reset(ctx->cctx);

crypto/cmac/cmac.c:65:5: when calling `EVP_CIPHER_CTX_reset` here
    63.   void CMAC_CTX_cleanup(CMAC_CTX *ctx)
    64.   {
    65.       EVP_CIPHER_CTX_reset(ctx->cctx);
              ^
    66.       OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
    67.       OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);

crypto/evp/evp_enc.c:21:1: parameter `c` of EVP_CIPHER_CTX_reset
      19.   #include "evp_locl.h"
      20.   
      21. > int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
      22.   {
      23.       if (c == NULL)

crypto/evp/evp_enc.c:32:5: when calling `CRYPTO_free` here
      30.               OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);
      31.       }
      32.       OPENSSL_free(c->cipher_data);
                ^
      33.   #ifndef OPENSSL_NO_ENGINE
      34.       ENGINE_finish(c->engine);

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
        293.   }
        294.   
        295. > void CRYPTO_free(void *str, const char *file, int line)
        296.   {
        297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
        310.       }
        311.   #else
        312.       free(str);
                   ^
        313.   #endif
        314.   }

crypto/cmac/cmac.c:78:1: use-after-lifetime part of the trace starts here
76.   }
77.   
78. > void CMAC_CTX_free(CMAC_CTX *ctx)
79.   {
80.       if (!ctx)

crypto/cmac/cmac.c:78:1: parameter `ctx` of CMAC_CTX_free
  76.   }
  77.   
  78. > void CMAC_CTX_free(CMAC_CTX *ctx)
  79.   {
  80.       if (!ctx)

crypto/cmac/cmac.c:83:5: when calling `EVP_CIPHER_CTX_free` here
  81.           return;
  82.       CMAC_CTX_cleanup(ctx);
  83.       EVP_CIPHER_CTX_free(ctx->cctx);
            ^
  84.       OPENSSL_free(ctx);
  85.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['void CMAC_CTX_free(CMAC_CTX *ctx)\n{\n    if (!ctx)\n        return;\n    CMAC_CTX_cleanup(ctx);\n    EVP_CIPHER_CTX_free(ctx->cctx);\n    OPENSSL_free(ctx);\n}', 'void CMAC_CTX_cleanup(CMAC_CTX *ctx)\n{\n    EVP_CIPHER_CTX_reset(ctx->cctx);\n    OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);\n    OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);\n    OPENSSL_cleanse(ctx->k2, EVP_MAX_BLOCK_LENGTH);\n    OPENSSL_cleanse(ctx->last_block, EVP_MAX_BLOCK_LENGTH);\n    ctx->nlast_block = -1;\n}', 'int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)\n{\n    if (c == NULL)\n        return 1;\n    if (c->cipher != NULL) {\n        if (c->cipher->cleanup && !c->cipher->cleanup(c))\n            return 0;\n        if (c->cipher_data && c->cipher->ctx_size)\n            OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);\n    }\n    OPENSSL_free(c->cipher_data);\n#ifndef OPENSSL_NO_ENGINE\n    ENGINE_finish(c->engine);\n#endif\n    memset(c, 0, sizeof(*c));\n    return 1;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']