apps/ts.c:538: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_free()` eventually accesses memory that was invalidated by call to `free()` on line 537 indirectly during the call to `EVP_DigestFinal()`.
Showing all 28 steps of the trace


apps/ts.c:526:30: invalidation part of the trace starts here
524.   
525.       if (input) {
526.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                    ^
527.           unsigned char buffer[4096];
528.           int length;

apps/ts.c:526:30: passed as argument to `EVP_MD_CTX_new`
  524.   
  525.       if (input) {
  526.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  527.           unsigned char buffer[4096];
  528.           int length;

apps/ts.c:526:30: return from call to `EVP_MD_CTX_new`
  524.   
  525.       if (input) {
  526.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  527.           unsigned char buffer[4096];
  528.           int length;

apps/ts.c:526:9: assigned
  524.   
  525.       if (input) {
  526.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                 ^
  527.           unsigned char buffer[4096];
  528.           int length;

apps/ts.c:537:14: when calling `EVP_DigestFinal` here
  535.               EVP_DigestUpdate(md_ctx, buffer, length);
  536.           }
  537.           if (!EVP_DigestFinal(md_ctx, *md_value, NULL)) {
                      ^
  538.               EVP_MD_CTX_free(md_ctx);
  539.               return 0;

crypto/evp/digest.c:260:1: parameter `ctx` of EVP_DigestFinal
    258.   
    259.   /* The caller can assume that this removes any secret data from the context */
    260. > int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
    261.   {
    262.       int ret;

crypto/evp/digest.c:264:5: when calling `EVP_MD_CTX_reset` here
    262.       int ret;
    263.       ret = EVP_DigestFinal_ex(ctx, md, size);
    264.       EVP_MD_CTX_reset(ctx);
               ^
    265.       return ret;
    266.   }

crypto/evp/digest.c:122:1: parameter `ctx` of EVP_MD_CTX_reset
      120.   
      121.   /* This call frees resources associated with the context */
      122. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
      123.   {
      124.       if (ctx == NULL)

crypto/evp/digest.c:138:5: when calling `EVP_PKEY_CTX_free` here
      136.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
      137.       }
      138.       EVP_PKEY_CTX_free(ctx->pctx);
                 ^
      139.   #ifndef OPENSSL_NO_ENGINE
      140.       if (ctx->engine)

crypto/evp/pmeth_lib.c:323:1: parameter `ctx` of EVP_PKEY_CTX_free
        321.   }
        322.   
        323. > void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)
        324.   {
        325.       if (ctx == NULL)

crypto/evp/pmeth_lib.c:330:5: when calling `EVP_PKEY_free` here
        328.           ctx->pmeth->cleanup(ctx);
        329.       EVP_PKEY_free(ctx->pkey);
        330.       EVP_PKEY_free(ctx->peerkey);
                   ^
        331.   #ifndef OPENSSL_NO_ENGINE
        332.       if (ctx->engine)

crypto/evp/p_lib.c:420:1: parameter `x` of EVP_PKEY_free
          418.   }
          419.   
          420. > void EVP_PKEY_free(EVP_PKEY *x)
          421.   {
          422.       int i;

crypto/evp/p_lib.c:433:5: when calling `sk_X509_ATTRIBUTE_pop_free` here
          431.       REF_ASSERT_ISNT(i < 0);
          432.       EVP_PKEY_free_it(x);
          433.       sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
                     ^
          434.       OPENSSL_free(x);
          435.   }

include/openssl/x509.h:159:1: parameter `sk` of sk_X509_ATTRIBUTE_pop_free
            157.   typedef struct x509_attributes_st X509_ATTRIBUTE;
            158.   
            159. > DEFINE_STACK_OF(X509_ATTRIBUTE)
            160.   
            161.   typedef struct X509_req_info_st X509_REQ_INFO;

include/openssl/x509.h:159:1: when calling `sk_pop_free` here
            157.   typedef struct x509_attributes_st X509_ATTRIBUTE;
            158.   
            159. > DEFINE_STACK_OF(X509_ATTRIBUTE)
            160.   
            161.   typedef struct X509_req_info_st X509_REQ_INFO;

crypto/stack/stack.c:296:1: parameter `st` of sk_pop_free
              294.   }
              295.   
              296. > void sk_pop_free(_STACK *st, void (*func) (void *))
              297.   {
              298.       int i;

crypto/stack/stack.c:305:5: when calling `sk_free` here
              303.           if (st->data[i] != NULL)
              304.               func(st->data[i]);
              305.       sk_free(st);
                         ^
              306.   }
              307.   

crypto/stack/stack.c:308:1: parameter `st` of sk_free
                306.   }
                307.   
                308. > void sk_free(_STACK *st)
                309.   {
                310.       if (st == NULL)

crypto/stack/stack.c:312:5: when calling `CRYPTO_free` here
                310.       if (st == NULL)
                311.           return;
                312.       OPENSSL_free(st->data);
                           ^
                313.       OPENSSL_free(st);
                314.   }

crypto/mem.c:225:1: parameter `str` of CRYPTO_free
                  223.   }
                  224.   
                  225. > void CRYPTO_free(void *str, const char *file, int line)
                  226.   {
                  227.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:241:5: was invalidated by call to `free()`
                  239.       }
                  240.   #else
                  241.       free(str);
                             ^
                  242.   #endif
                  243.   }

apps/ts.c:526:30: use-after-lifetime part of the trace starts here
524.   
525.       if (input) {
526.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                    ^
527.           unsigned char buffer[4096];
528.           int length;

apps/ts.c:526:30: passed as argument to `EVP_MD_CTX_new`
  524.   
  525.       if (input) {
  526.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  527.           unsigned char buffer[4096];
  528.           int length;

apps/ts.c:526:30: return from call to `EVP_MD_CTX_new`
  524.   
  525.       if (input) {
  526.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  527.           unsigned char buffer[4096];
  528.           int length;

apps/ts.c:526:9: assigned
  524.   
  525.       if (input) {
  526.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                 ^
  527.           unsigned char buffer[4096];
  528.           int length;

apps/ts.c:538:13: when calling `EVP_MD_CTX_free` here
  536.           }
  537.           if (!EVP_DigestFinal(md_ctx, *md_value, NULL)) {
  538.               EVP_MD_CTX_free(md_ctx);
                     ^
  539.               return 0;
  540.           }

crypto/mem.c:225:1: parameter `str` of CRYPTO_free
    223.   }
    224.   
    225. > void CRYPTO_free(void *str, const char *file, int line)
    226.   {
    227.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:241:5: invalid access occurs here
    239.       }
    240.   #else
    241.       free(str);
               ^
    242.   #endif
    243.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int create_digest(BIO *input, char *digest, const EVP_MD *md,\n                         unsigned char **md_value)\n{\n    int md_value_len;\n    md_value_len = EVP_MD_size(md);\n    if (md_value_len < 0)\n        return 0;\n    if (input) {\n        EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();\n        unsigned char buffer[4096];\n        int length;\n        if (md_ctx == NULL)\n            return 0;\n        *md_value = app_malloc(md_value_len, "digest buffer");\n        EVP_DigestInit(md_ctx, md);\n        while ((length = BIO_read(input, buffer, sizeof(buffer))) > 0) {\n            EVP_DigestUpdate(md_ctx, buffer, length);\n        }\n        if (!EVP_DigestFinal(md_ctx, *md_value, NULL)) {\n            EVP_MD_CTX_free(md_ctx);\n            return 0;\n        }\n        EVP_MD_CTX_free(md_ctx);\n    } else {\n        long digest_len;\n        *md_value = string_to_hex(digest, &digest_len);\n        if (!*md_value || md_value_len != digest_len) {\n            OPENSSL_free(*md_value);\n            *md_value = NULL;\n            BIO_printf(bio_err, "bad digest, %d bytes "\n                       "must be specified\\n", md_value_len);\n            return 0;\n        }\n    }\n    return md_value_len;\n}', 'int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)\n{\n    int ret;\n    ret = EVP_DigestFinal_ex(ctx, md, size);\n    EVP_MD_CTX_reset(ctx);\n    return ret;\n}', 'int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)\n{\n    if (ctx == NULL)\n        return 1;\n    if (ctx->digest && ctx->digest->cleanup\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_CLEANED))\n        ctx->digest->cleanup(ctx);\n    if (ctx->digest && ctx->digest->ctx_size && ctx->md_data\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {\n        OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);\n    }\n    EVP_PKEY_CTX_free(ctx->pctx);\n#ifndef OPENSSL_NO_ENGINE\n    if (ctx->engine)\n        ENGINE_finish(ctx->engine);\n#endif\n    memset(ctx, 0, sizeof(*ctx));\n    return 1;\n}', 'void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)\n{\n    if (ctx == NULL)\n        return;\n    if (ctx->pmeth && ctx->pmeth->cleanup)\n        ctx->pmeth->cleanup(ctx);\n    EVP_PKEY_free(ctx->pkey);\n    EVP_PKEY_free(ctx->peerkey);\n#ifndef OPENSSL_NO_ENGINE\n    if (ctx->engine)\n        ENGINE_finish(ctx->engine);\n#endif\n    OPENSSL_free(ctx);\n}', 'void EVP_PKEY_free(EVP_PKEY *x)\n{\n    int i;\n    if (x == NULL)\n        return;\n    i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_EVP_PKEY);\n    REF_PRINT_COUNT("EVP_PKEY", x);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    EVP_PKEY_free_it(x);\n    sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);\n    OPENSSL_free(x);\n}', 'void sk_pop_free(_STACK *st, void (*func) (void *))\n{\n    int i;\n    if (st == NULL)\n        return;\n    for (i = 0; i < st->num; i++)\n        if (st->data[i] != NULL)\n            func(st->data[i]);\n    sk_free(st);\n}', 'void sk_free(_STACK *st)\n{\n    if (st == NULL)\n        return;\n    OPENSSL_free(st->data);\n    OPENSSL_free(st);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']