crypto/evp/evp_enc.c:54: error: USE_AFTER_FREE
  call to `EVP_CipherInit_ex()` eventually accesses memory that was invalidated by call to `free()` on line 53 indirectly during the call to `EVP_CIPHER_CTX_reset()`.
Showing all 18 steps of the trace


crypto/evp/evp_enc.c:50:1: invalidation part of the trace starts here
48.   }
49.   
50. > int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
51.                      const unsigned char *key, const unsigned char *iv, int enc)
52.   {

crypto/evp/evp_enc.c:50:1: parameter `ctx` of EVP_CipherInit
  48.   }
  49.   
  50. > int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
  51.                      const unsigned char *key, const unsigned char *iv, int enc)
  52.   {

crypto/evp/evp_enc.c:53:5: when calling `EVP_CIPHER_CTX_reset` here
  51.                      const unsigned char *key, const unsigned char *iv, int enc)
  52.   {
  53.       EVP_CIPHER_CTX_reset(ctx);
            ^
  54.       return EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, enc);
  55.   }

crypto/evp/evp_enc.c:20:1: parameter `c` of EVP_CIPHER_CTX_reset
    18.   #include "evp_locl.h"
    19.   
    20. > int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
    21.   {
    22.       if (c == NULL)

crypto/evp/evp_enc.c:33:5: when calling `ENGINE_finish` here
    31.       OPENSSL_free(c->cipher_data);
    32.   #ifndef OPENSSL_NO_ENGINE
    33.       ENGINE_finish(c->engine);
              ^
    34.   #endif
    35.       memset(c, 0, sizeof(*c));

crypto/engine/eng_init.c:94:1: parameter `e` of ENGINE_finish
      92.   
      93.   /* The API (locked) version of "finish" */
      94. > int ENGINE_finish(ENGINE *e)
      95.   {
      96.       int to_return = 1;

crypto/engine/eng_init.c:101:17: when calling `engine_unlocked_finish` here
      99.           return 1;
      100.       CRYPTO_THREAD_write_lock(global_engine_lock);
      101.       to_return = engine_unlocked_finish(e, 1);
                             ^
      102.       CRYPTO_THREAD_unlock(global_engine_lock);
      103.       if (!to_return) {

crypto/engine/eng_init.c:43:1: parameter `e` of engine_unlocked_finish
        41.    * internally.
        42.    */
        43. > int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers)
        44.   {
        45.       int to_return = 1;

crypto/engine/eng_init.c:68:10: when calling `engine_free_util` here
        66.       REF_ASSERT_ISNT(e->funct_ref < 0);
        67.       /* Release the structural reference too */
        68.       if (!engine_free_util(e, 0)) {
                       ^
        69.           ENGINEerr(ENGINE_F_ENGINE_UNLOCKED_FINISH, ENGINE_R_FINISH_FAILED);
        70.           return 0;

crypto/engine/eng_lib.c:70:1: parameter `e` of engine_free_util
          68.   }
          69.   
          70. > int engine_free_util(ENGINE *e, int not_locked)
          71.   {
          72.       int i;

crypto/engine/eng_lib.c:98:5: when calling `CRYPTO_free` here
          96.           e->destroy(e);
          97.       CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ENGINE, e, &e->ex_data);
          98.       OPENSSL_free(e);
                     ^
          99.       return 1;
          100.   }

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
            161.   }
            162.   
            163. > void CRYPTO_free(void *str, const char *file, int line)
            164.   {
            165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
            177.       }
            178.   #else
            179.       free(str);
                       ^
            180.   #endif
            181.   }

crypto/evp/evp_enc.c:50:1: use-after-lifetime part of the trace starts here
48.   }
49.   
50. > int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
51.                      const unsigned char *key, const unsigned char *iv, int enc)
52.   {

crypto/evp/evp_enc.c:50:1: parameter `ctx` of EVP_CipherInit
  48.   }
  49.   
  50. > int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
  51.                      const unsigned char *key, const unsigned char *iv, int enc)
  52.   {

crypto/evp/evp_enc.c:54:12: when calling `EVP_CipherInit_ex` here
  52.   {
  53.       EVP_CIPHER_CTX_reset(ctx);
  54.       return EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, enc);
                   ^
  55.   }
  56.   

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
    161.   }
    162.   
    163. > void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: invalid access occurs here
    177.       }
    178.   #else
    179.       free(str);
               ^
    180.   #endif
    181.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,\n                   const unsigned char *key, const unsigned char *iv, int enc)\n{\n    EVP_CIPHER_CTX_reset(ctx);\n    return EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, enc);\n}', 'int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)\n{\n    if (c == NULL)\n        return 1;\n    if (c->cipher != NULL) {\n        if (c->cipher->cleanup && !c->cipher->cleanup(c))\n            return 0;\n        if (c->cipher_data && c->cipher->ctx_size)\n            OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);\n    }\n    OPENSSL_free(c->cipher_data);\n#ifndef OPENSSL_NO_ENGINE\n    ENGINE_finish(c->engine);\n#endif\n    memset(c, 0, sizeof(*c));\n    return 1;\n}', 'int ENGINE_finish(ENGINE *e)\n{\n    int to_return = 1;\n    if (e == NULL)\n        return 1;\n    CRYPTO_THREAD_write_lock(global_engine_lock);\n    to_return = engine_unlocked_finish(e, 1);\n    CRYPTO_THREAD_unlock(global_engine_lock);\n    if (!to_return) {\n        ENGINEerr(ENGINE_F_ENGINE_FINISH, ENGINE_R_FINISH_FAILED);\n        return 0;\n    }\n    return to_return;\n}', 'int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers)\n{\n    int to_return = 1;\n    e->funct_ref--;\n    engine_ref_debug(e, 1, -1);\n    if ((e->funct_ref == 0) && e->finish) {\n        if (unlock_for_handlers)\n            CRYPTO_THREAD_unlock(global_engine_lock);\n        to_return = e->finish(e);\n        if (unlock_for_handlers)\n            CRYPTO_THREAD_write_lock(global_engine_lock);\n        if (!to_return)\n            return 0;\n    }\n    REF_ASSERT_ISNT(e->funct_ref < 0);\n    if (!engine_free_util(e, 0)) {\n        ENGINEerr(ENGINE_F_ENGINE_UNLOCKED_FINISH, ENGINE_R_FINISH_FAILED);\n        return 0;\n    }\n    return to_return;\n}', 'int engine_free_util(ENGINE *e, int not_locked)\n{\n    int i;\n    if (e == NULL)\n        return 1;\n#ifdef HAVE_ATOMICS\n    CRYPTO_DOWN_REF(&e->struct_ref, &i, global_engine_lock);\n#else\n    if (not_locked)\n        CRYPTO_atomic_add(&e->struct_ref, -1, &i, global_engine_lock);\n    else\n        i = --e->struct_ref;\n#endif\n    engine_ref_debug(e, 0, -1)\n    if (i > 0)\n        return 1;\n    REF_ASSERT_ISNT(i < 0);\n    engine_pkey_meths_free(e);\n    engine_pkey_asn1_meths_free(e);\n    if (e->destroy)\n        e->destroy(e);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ENGINE, e, &e->ex_data);\n    OPENSSL_free(e);\n    return 1;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']