crypto/evp/digest.c:288: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_copy_ex()` eventually accesses memory that was invalidated by call to `free()` on line 287 indirectly during the call to `EVP_MD_CTX_reset()`.
Showing all 14 steps of the trace


crypto/evp/digest.c:285:1: invalidation part of the trace starts here
283.   }
284.   
285. > int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
286.   {
287.       EVP_MD_CTX_reset(out);

crypto/evp/digest.c:285:1: parameter `out` of EVP_MD_CTX_copy
  283.   }
  284.   
  285. > int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
  286.   {
  287.       EVP_MD_CTX_reset(out);

crypto/evp/digest.c:287:5: when calling `EVP_MD_CTX_reset` here
  285.   int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
  286.   {
  287.       EVP_MD_CTX_reset(out);
             ^
  288.       return EVP_MD_CTX_copy_ex(out, in);
  289.   }

crypto/evp/digest.c:122:1: parameter `ctx` of EVP_MD_CTX_reset
    120.   
    121.   /* This call frees resources associated with the context */
    122. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
    123.   {
    124.       if (ctx == NULL)

crypto/evp/digest.c:136:9: when calling `CRYPTO_clear_free` here
    134.       if (ctx->digest && ctx->digest->ctx_size && ctx->md_data
    135.           && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {
    136.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
                   ^
    137.       }
    138.       EVP_PKEY_CTX_free(ctx->pctx);

crypto/mem.c:248:1: parameter `str` of CRYPTO_clear_free
      246.   }
      247.   
      248. > void CRYPTO_clear_free(void *str, size_t num)
      249.   {
      250.       if (str == NULL)

crypto/mem.c:254:5: when calling `CRYPTO_free` here
      252.       if (num)
      253.           OPENSSL_cleanse(str, num);
      254.       CRYPTO_free(str);
                 ^
      255.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
        231.   }
        232.   
        233. > void CRYPTO_free(void *str)
        234.   {
        235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
        242.       }
        243.   #else
        244.       free(str);
                   ^
        245.   #endif
        246.   }

crypto/evp/digest.c:285:1: use-after-lifetime part of the trace starts here
283.   }
284.   
285. > int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
286.   {
287.       EVP_MD_CTX_reset(out);

crypto/evp/digest.c:285:1: parameter `out` of EVP_MD_CTX_copy
  283.   }
  284.   
  285. > int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
  286.   {
  287.       EVP_MD_CTX_reset(out);

crypto/evp/digest.c:288:12: when calling `EVP_MD_CTX_copy_ex` here
  286.   {
  287.       EVP_MD_CTX_reset(out);
  288.       return EVP_MD_CTX_copy_ex(out, in);
                    ^
  289.   }
  290.   

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }

void CRYPTO_free(void *str)
{
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0);
        free(str);
        CRYPTO_mem_debug_free(str, 1);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)\n{\n    EVP_MD_CTX_reset(out);\n    return EVP_MD_CTX_copy_ex(out, in);\n}', 'int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)\n{\n    if (ctx == NULL)\n        return 1;\n    if (ctx->digest && ctx->digest->cleanup\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_CLEANED))\n        ctx->digest->cleanup(ctx);\n    if (ctx->digest && ctx->digest->ctx_size && ctx->md_data\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {\n        OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);\n    }\n    EVP_PKEY_CTX_free(ctx->pctx);\n#ifndef OPENSSL_NO_ENGINE\n    if (ctx->engine)\n        ENGINE_finish(ctx->engine);\n#endif\n    memset(ctx, 0, sizeof(*ctx));\n    return 1;\n}', 'void CRYPTO_clear_free(void *str, size_t num)\n{\n    if (str == NULL)\n        return;\n    if (num)\n        OPENSSL_cleanse(str, num);\n    CRYPTO_free(str);\n}', 'void CRYPTO_free(void *str)\n{\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']