crypto/asn1/p5_pbev2.c:107: error: USE_AFTER_FREE
  call to `OBJ_nid2obj()` eventually accesses memory that was invalidated by call to `free()` on line 101 indirectly during the call to `EVP_CIPHER_type()`.
Showing all 17 steps of the trace


crypto/asn1/p5_pbev2.c:101:15: invalidation part of the trace starts here
99.       ASN1_OBJECT *obj;
100.   
101.       alg_nid = EVP_CIPHER_type(cipher);
                     ^
102.       if (alg_nid == NID_undef) {
103.           ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,

crypto/asn1/p5_pbev2.c:101:15: global variable `nid_objs` accessed here
  99.       ASN1_OBJECT *obj;
  100.   
  101.       alg_nid = EVP_CIPHER_type(cipher);
                       ^
  102.       if (alg_nid == NID_undef) {
  103.           ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,

crypto/asn1/p5_pbev2.c:101:15: when calling `EVP_CIPHER_type` here
  99.       ASN1_OBJECT *obj;
  100.   
  101.       alg_nid = EVP_CIPHER_type(cipher);
                       ^
  102.       if (alg_nid == NID_undef) {
  103.           ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,

crypto/evp/evp_lib.c:206:16: global variable `nid_objs` accessed here
    204.       default:
    205.           /* Check it has an OID and it is valid */
    206.           otmp = OBJ_nid2obj(nid);
                          ^
    207.           if (OBJ_get0_data(otmp) == NULL)
    208.               nid = NID_undef;

crypto/evp/evp_lib.c:206:16: passed as argument to `OBJ_nid2obj`
    204.       default:
    205.           /* Check it has an OID and it is valid */
    206.           otmp = OBJ_nid2obj(nid);
                          ^
    207.           if (OBJ_get0_data(otmp) == NULL)
    208.               nid = NID_undef;

crypto/evp/evp_lib.c:206:16: return from call to `OBJ_nid2obj`
    204.       default:
    205.           /* Check it has an OID and it is valid */
    206.           otmp = OBJ_nid2obj(nid);
                          ^
    207.           if (OBJ_get0_data(otmp) == NULL)
    208.               nid = NID_undef;

crypto/evp/evp_lib.c:206:9: assigned
    204.       default:
    205.           /* Check it has an OID and it is valid */
    206.           otmp = OBJ_nid2obj(nid);
                   ^
    207.           if (OBJ_get0_data(otmp) == NULL)
    208.               nid = NID_undef;

crypto/evp/evp_lib.c:209:9: when calling `ASN1_OBJECT_free` here
    207.           if (OBJ_get0_data(otmp) == NULL)
    208.               nid = NID_undef;
    209.           ASN1_OBJECT_free(otmp);
                   ^
    210.           return nid;
    211.       }

crypto/asn1/a_object.c:380:1: parameter `a` of ASN1_OBJECT_free
      378.   }
      379.   
      380. > void ASN1_OBJECT_free(ASN1_OBJECT *a)
      381.   {
      382.       if (a == NULL)

crypto/asn1/a_object.c:399:9: when calling `CRYPTO_free` here
      397.       }
      398.       if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC)
      399.           OPENSSL_free(a);
                     ^
      400.   }
      401.   

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
        232.   }
        233.   
        234. > void CRYPTO_free(void *str)
        235.   {
        236.   #ifdef CRYPTO_MDEBUG

crypto/mem.c:245:5: was invalidated by call to `free()`
        243.       }
        244.   #else
        245.       free(str);
                   ^
        246.   #endif
        247.   }

crypto/asn1/p5_pbev2.c:101:15: use-after-lifetime part of the trace starts here
99.       ASN1_OBJECT *obj;
100.   
101.       alg_nid = EVP_CIPHER_type(cipher);
                     ^
102.       if (alg_nid == NID_undef) {
103.           ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,

crypto/asn1/p5_pbev2.c:101:15: global variable `nid_objs` accessed here
  99.       ASN1_OBJECT *obj;
  100.   
  101.       alg_nid = EVP_CIPHER_type(cipher);
                       ^
  102.       if (alg_nid == NID_undef) {
  103.           ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,

crypto/asn1/p5_pbev2.c:107:11: when calling `OBJ_nid2obj` here
  105.           goto err;
  106.       }
  107.       obj = OBJ_nid2obj(alg_nid);
                   ^
  108.   
  109.       if ((pbe2 = PBE2PARAM_new()) == NULL)

crypto/objects/obj_dat.c:299:34: global variable `nid_objs` accessed here
    297.   
    298.       if ((n >= 0) && (n < NUM_NID)) {
    299.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
                                            ^
    300.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);
    301.               return (NULL);

crypto/objects/obj_dat.c:299:34: invalid access occurs here
    297.   
    298.       if ((n >= 0) && (n < NUM_NID)) {
    299.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
                                            ^
    300.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);
    301.               return (NULL);

ASN1_OBJECT *OBJ_nid2obj(int n)
{
    ADDED_OBJ ad, *adp;
    ASN1_OBJECT ob;
    if ((n >= 0) && (n < NUM_NID)) {
        if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
            OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);
            return (NULL);
        }
        return ((ASN1_OBJECT *)&(nid_objs[n]));
    } else if (added == NULL)
        return (NULL);
    else {
        ad.type = ADDED_NID;
        ad.obj = &ob;
        ob.nid = n;
        adp = lh_ADDED_OBJ_retrieve(added, &ad);
        if (adp != NULL)
            return (adp->obj);
        else {
            OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);
            return (NULL);
        }
    }
}
['X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,\n                              unsigned char *salt, int saltlen,\n                              unsigned char *aiv, int prf_nid)\n{\n    X509_ALGOR *scheme = NULL, *kalg = NULL, *ret = NULL;\n    int alg_nid, keylen;\n    EVP_CIPHER_CTX ctx;\n    unsigned char iv[EVP_MAX_IV_LENGTH];\n    PBE2PARAM *pbe2 = NULL;\n    ASN1_OBJECT *obj;\n    alg_nid = EVP_CIPHER_type(cipher);\n    if (alg_nid == NID_undef) {\n        ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,\n                ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);\n        goto err;\n    }\n    obj = OBJ_nid2obj(alg_nid);\n    if ((pbe2 = PBE2PARAM_new()) == NULL)\n        goto merr;\n    scheme = pbe2->encryption;\n    scheme->algorithm = obj;\n    if ((scheme->parameter = ASN1_TYPE_new()) == NULL)\n        goto merr;\n    if (EVP_CIPHER_iv_length(cipher)) {\n        if (aiv)\n            memcpy(iv, aiv, EVP_CIPHER_iv_length(cipher));\n        else if (RAND_bytes(iv, EVP_CIPHER_iv_length(cipher)) <= 0)\n            goto err;\n    }\n    EVP_CIPHER_CTX_init(&ctx);\n    if (!EVP_CipherInit_ex(&ctx, cipher, NULL, NULL, iv, 0))\n        goto err;\n    if (EVP_CIPHER_param_to_asn1(&ctx, scheme->parameter) < 0) {\n        ASN1err(ASN1_F_PKCS5_PBE2_SET_IV, ASN1_R_ERROR_SETTING_CIPHER_PARAMS);\n        EVP_CIPHER_CTX_cleanup(&ctx);\n        goto err;\n    }\n    if ((prf_nid == -1) &&\n        EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_PBE_PRF_NID, 0, &prf_nid) <= 0) {\n        ERR_clear_error();\n        prf_nid = NID_hmacWithSHA1;\n    }\n    EVP_CIPHER_CTX_cleanup(&ctx);\n    if (alg_nid == NID_rc2_cbc)\n        keylen = EVP_CIPHER_key_length(cipher);\n    else\n        keylen = -1;\n    X509_ALGOR_free(pbe2->keyfunc);\n    pbe2->keyfunc = PKCS5_pbkdf2_set(iter, salt, saltlen, prf_nid, keylen);\n    if (!pbe2->keyfunc)\n        goto merr;\n    if ((ret = X509_ALGOR_new()) == NULL)\n        goto merr;\n    ret->algorithm = OBJ_nid2obj(NID_pbes2);\n    if (!ASN1_TYPE_pack_sequence(ASN1_ITEM_rptr(PBE2PARAM), pbe2,\n                                 &ret->parameter))\n         goto merr;\n    PBE2PARAM_free(pbe2);\n    pbe2 = NULL;\n    return ret;\n merr:\n    ASN1err(ASN1_F_PKCS5_PBE2_SET_IV, ERR_R_MALLOC_FAILURE);\n err:\n    PBE2PARAM_free(pbe2);\n    X509_ALGOR_free(kalg);\n    X509_ALGOR_free(ret);\n    return NULL;\n}', 'int EVP_CIPHER_type(const EVP_CIPHER *ctx)\n{\n    int nid;\n    ASN1_OBJECT *otmp;\n    nid = EVP_CIPHER_nid(ctx);\n    switch (nid) {\n    case NID_rc2_cbc:\n    case NID_rc2_64_cbc:\n    case NID_rc2_40_cbc:\n        return NID_rc2_cbc;\n    case NID_rc4:\n    case NID_rc4_40:\n        return NID_rc4;\n    case NID_aes_128_cfb128:\n    case NID_aes_128_cfb8:\n    case NID_aes_128_cfb1:\n        return NID_aes_128_cfb128;\n    case NID_aes_192_cfb128:\n    case NID_aes_192_cfb8:\n    case NID_aes_192_cfb1:\n        return NID_aes_192_cfb128;\n    case NID_aes_256_cfb128:\n    case NID_aes_256_cfb8:\n    case NID_aes_256_cfb1:\n        return NID_aes_256_cfb128;\n    case NID_des_cfb64:\n    case NID_des_cfb8:\n    case NID_des_cfb1:\n        return NID_des_cfb64;\n    case NID_des_ede3_cfb64:\n    case NID_des_ede3_cfb8:\n    case NID_des_ede3_cfb1:\n        return NID_des_cfb64;\n    default:\n        otmp = OBJ_nid2obj(nid);\n        if (OBJ_get0_data(otmp) == NULL)\n            nid = NID_undef;\n        ASN1_OBJECT_free(otmp);\n        return nid;\n    }\n}', 'void ASN1_OBJECT_free(ASN1_OBJECT *a)\n{\n    if (a == NULL)\n        return;\n    if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS) {\n#ifndef CONST_STRICT\n        OPENSSL_free((void*)a->sn);\n        OPENSSL_free((void*)a->ln);\n#endif\n        a->sn = a->ln = NULL;\n    }\n    if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_DATA) {\n        OPENSSL_free((void*)a->data);\n        a->data = NULL;\n        a->length = 0;\n    }\n    if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC)\n        OPENSSL_free(a);\n}', 'void CRYPTO_free(void *str)\n{\n#ifdef CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}', 'ASN1_OBJECT *OBJ_nid2obj(int n)\n{\n    ADDED_OBJ ad, *adp;\n    ASN1_OBJECT ob;\n    if ((n >= 0) && (n < NUM_NID)) {\n        if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {\n            OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);\n            return (NULL);\n        }\n        return ((ASN1_OBJECT *)&(nid_objs[n]));\n    } else if (added == NULL)\n        return (NULL);\n    else {\n        ad.type = ADDED_NID;\n        ad.obj = &ob;\n        ob.nid = n;\n        adp = lh_ADDED_OBJ_retrieve(added, &ad);\n        if (adp != NULL)\n            return (adp->obj);\n        else {\n            OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);\n            return (NULL);\n        }\n    }\n}']