ssl/t1_enc.c:397: error: USE_AFTER_FREE
  call to `EVP_CipherInit_ex()` eventually accesses memory that was invalidated by call to `free()` on line 316 indirectly during the call to `EVP_CIPHER_CTX_reset()`.
Showing all 14 steps of the trace


ssl/t1_enc.c:206:1: invalidation part of the trace starts here
204.   }
205.   
206. > int tls1_change_cipher_state(SSL *s, int which)
207.   {
208.       unsigned char *p, *mac_secret;

ssl/t1_enc.c:206:1: parameter `s` of tls1_change_cipher_state
  204.   }
  205.   
  206. > int tls1_change_cipher_state(SSL *s, int which)
  207.   {
  208.       unsigned char *p, *mac_secret;

ssl/t1_enc.c:283:9: assigned
  281.           else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)
  282.               goto err;
  283.           dd = s->enc_write_ctx;
                 ^
  284.           if (SSL_IS_DTLS(s)) {
  285.               mac_ctx = EVP_MD_CTX_new();

ssl/t1_enc.c:316:9: when calling `EVP_CIPHER_CTX_reset` here
  314.   
  315.       if (reuse_dd)
  316.           EVP_CIPHER_CTX_reset(dd);
                 ^
  317.   
  318.       p = s->s3->tmp.key_block;

crypto/evp/evp_enc.c:69:1: parameter `c` of EVP_CIPHER_CTX_reset
    67.   #include "evp_locl.h"
    68.   
    69. > int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
    70.   {
    71.       if (c == NULL)

crypto/evp/evp_enc.c:80:5: when calling `CRYPTO_free` here
    78.               OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);
    79.       }
    80.       OPENSSL_free(c->cipher_data);
              ^
    81.   #ifndef OPENSSL_NO_ENGINE
    82.       if (c->engine)

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }

ssl/t1_enc.c:206:1: use-after-lifetime part of the trace starts here
204.   }
205.   
206. > int tls1_change_cipher_state(SSL *s, int which)
207.   {
208.       unsigned char *p, *mac_secret;

ssl/t1_enc.c:206:1: parameter `s` of tls1_change_cipher_state
  204.   }
  205.   
  206. > int tls1_change_cipher_state(SSL *s, int which)
  207.   {
  208.       unsigned char *p, *mac_secret;

ssl/t1_enc.c:283:9: assigned
  281.           else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)
  282.               goto err;
  283.           dd = s->enc_write_ctx;
                 ^
  284.           if (SSL_IS_DTLS(s)) {
  285.               mac_ctx = EVP_MD_CTX_new();

ssl/t1_enc.c:397:14: when calling `EVP_CipherInit_ex` here
  395.           }
  396.       } else {
  397.           if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) {
                      ^
  398.               SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
  399.               goto err2;

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }

void CRYPTO_free(void *str)
{
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0);
        free(str);
        CRYPTO_mem_debug_free(str, 1);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['int tls1_change_cipher_state(SSL *s, int which)\n{\n    unsigned char *p, *mac_secret;\n    unsigned char tmp1[EVP_MAX_KEY_LENGTH];\n    unsigned char tmp2[EVP_MAX_KEY_LENGTH];\n    unsigned char iv1[EVP_MAX_IV_LENGTH * 2];\n    unsigned char iv2[EVP_MAX_IV_LENGTH * 2];\n    unsigned char *ms, *key, *iv;\n    EVP_CIPHER_CTX *dd;\n    const EVP_CIPHER *c;\n#ifndef OPENSSL_NO_COMP\n    const SSL_COMP *comp;\n#endif\n    const EVP_MD *m;\n    int mac_type;\n    int *mac_secret_size;\n    EVP_MD_CTX *mac_ctx;\n    EVP_PKEY *mac_key;\n    int n, i, j, k, cl;\n    int reuse_dd = 0;\n    c = s->s3->tmp.new_sym_enc;\n    m = s->s3->tmp.new_hash;\n    mac_type = s->s3->tmp.new_mac_pkey_type;\n#ifndef OPENSSL_NO_COMP\n    comp = s->s3->tmp.new_compression;\n#endif\n    if (which & SSL3_CC_READ) {\n        if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)\n            s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM;\n        else\n            s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM;\n        if (s->enc_read_ctx != NULL)\n            reuse_dd = 1;\n        else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)\n            goto err;\n        else\n            EVP_CIPHER_CTX_reset(s->enc_read_ctx);\n        dd = s->enc_read_ctx;\n        mac_ctx = ssl_replace_hash(&s->read_hash, NULL);\n        if (mac_ctx == NULL)\n            goto err;\n#ifndef OPENSSL_NO_COMP\n        COMP_CTX_free(s->expand);\n        s->expand = NULL;\n        if (comp != NULL) {\n            s->expand = COMP_CTX_new(comp->method);\n            if (s->expand == NULL) {\n                SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,\n                       SSL_R_COMPRESSION_LIBRARY_ERROR);\n                goto err2;\n            }\n            if (!RECORD_LAYER_setup_comp_buffer(&s->rlayer))\n                goto err;\n        }\n#endif\n        if (!SSL_IS_DTLS(s))\n            RECORD_LAYER_reset_read_sequence(&s->rlayer);\n        mac_secret = &(s->s3->read_mac_secret[0]);\n        mac_secret_size = &(s->s3->read_mac_secret_size);\n    } else {\n        if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)\n            s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;\n        else\n            s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;\n        if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s))\n            reuse_dd = 1;\n        else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)\n            goto err;\n        dd = s->enc_write_ctx;\n        if (SSL_IS_DTLS(s)) {\n            mac_ctx = EVP_MD_CTX_new();\n            if (mac_ctx == NULL)\n                goto err;\n            s->write_hash = mac_ctx;\n        } else {\n            mac_ctx = ssl_replace_hash(&s->write_hash, NULL);\n            if (mac_ctx == NULL)\n                goto err;\n        }\n#ifndef OPENSSL_NO_COMP\n        COMP_CTX_free(s->compress);\n        s->compress = NULL;\n        if (comp != NULL) {\n            s->compress = COMP_CTX_new(comp->method);\n            if (s->compress == NULL) {\n                SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,\n                       SSL_R_COMPRESSION_LIBRARY_ERROR);\n                goto err2;\n            }\n        }\n#endif\n        if (!SSL_IS_DTLS(s))\n            RECORD_LAYER_reset_write_sequence(&s->rlayer);\n        mac_secret = &(s->s3->write_mac_secret[0]);\n        mac_secret_size = &(s->s3->write_mac_secret_size);\n    }\n    if (reuse_dd)\n        EVP_CIPHER_CTX_reset(dd);\n    p = s->s3->tmp.key_block;\n    i = *mac_secret_size = s->s3->tmp.new_mac_secret_size;\n    cl = EVP_CIPHER_key_length(c);\n    j = cl;\n    if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)\n        k = EVP_GCM_TLS_FIXED_IV_LEN;\n    else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE)\n        k = EVP_CCM_TLS_FIXED_IV_LEN;\n    else\n        k = EVP_CIPHER_iv_length(c);\n    if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||\n        (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {\n        ms = &(p[0]);\n        n = i + i;\n        key = &(p[n]);\n        n += j + j;\n        iv = &(p[n]);\n        n += k + k;\n    } else {\n        n = i;\n        ms = &(p[n]);\n        n += i + j;\n        key = &(p[n]);\n        n += j + k;\n        iv = &(p[n]);\n        n += k;\n    }\n    if (n > s->s3->tmp.key_block_length) {\n        SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n        goto err2;\n    }\n    memcpy(mac_secret, ms, i);\n    if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) {\n        mac_key = EVP_PKEY_new_mac_key(mac_type, NULL,\n                                       mac_secret, *mac_secret_size);\n        if (mac_key == NULL\n                || EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key) <= 0) {\n            EVP_PKEY_free(mac_key);\n            SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n            goto err2;\n        }\n        EVP_PKEY_free(mac_key);\n    }\n#ifdef TLS_DEBUG\n    printf("which = %04X\\nmac key=", which);\n    {\n        int z;\n        for (z = 0; z < i; z++)\n            printf("%02X%c", ms[z], ((z + 1) % 16) ? \' \' : \'\\n\');\n    }\n#endif\n    if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) {\n        if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE))\n            || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, k, iv)) {\n            SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n            goto err2;\n        }\n    } else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) {\n        int taglen;\n        if (s->s3->tmp.new_cipher->algorithm_enc & (SSL_AES128CCM8|SSL_AES256CCM8))\n            taglen = 8;\n        else\n            taglen = 16;\n        if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE))\n            || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL)\n            || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL)\n            || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, k, iv)\n            || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) {\n            SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n            goto err2;\n        }\n    } else {\n        if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) {\n            SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n            goto err2;\n        }\n    }\n    if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size\n        && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY,\n                                *mac_secret_size, mac_secret)) {\n        SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);\n        goto err2;\n    }\n#ifdef OPENSSL_SSL_TRACE_CRYPTO\n    if (s->msg_callback) {\n        int wh = which & SSL3_CC_WRITE ? TLS1_RT_CRYPTO_WRITE : 0;\n        if (*mac_secret_size)\n            s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_MAC,\n                            mac_secret, *mac_secret_size,\n                            s, s->msg_callback_arg);\n        if (c->key_len)\n            s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_KEY,\n                            key, c->key_len, s, s->msg_callback_arg);\n        if (k) {\n            if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)\n                wh |= TLS1_RT_CRYPTO_FIXED_IV;\n            else\n                wh |= TLS1_RT_CRYPTO_IV;\n            s->msg_callback(2, s->version, wh, iv, k, s, s->msg_callback_arg);\n        }\n    }\n#endif\n#ifdef TLS_DEBUG\n    printf("which = %04X\\nkey=", which);\n    {\n        int z;\n        for (z = 0; z < EVP_CIPHER_key_length(c); z++)\n            printf("%02X%c", key[z], ((z + 1) % 16) ? \' \' : \'\\n\');\n    }\n    printf("\\niv=");\n    {\n        int z;\n        for (z = 0; z < k; z++)\n            printf("%02X%c", iv[z], ((z + 1) % 16) ? \' \' : \'\\n\');\n    }\n    printf("\\n");\n#endif\n    OPENSSL_cleanse(tmp1, sizeof(tmp1));\n    OPENSSL_cleanse(tmp2, sizeof(tmp1));\n    OPENSSL_cleanse(iv1, sizeof(iv1));\n    OPENSSL_cleanse(iv2, sizeof(iv2));\n    return (1);\n err:\n    SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);\n err2:\n    OPENSSL_cleanse(tmp1, sizeof(tmp1));\n    OPENSSL_cleanse(tmp2, sizeof(tmp1));\n    OPENSSL_cleanse(iv1, sizeof(iv1));\n    OPENSSL_cleanse(iv2, sizeof(iv2));\n    return (0);\n}', 'int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)\n{\n    if (c == NULL)\n        return 1;\n    if (c->cipher != NULL) {\n        if (c->cipher->cleanup && !c->cipher->cleanup(c))\n            return 0;\n        if (c->cipher_data && c->cipher->ctx_size)\n            OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);\n    }\n    OPENSSL_free(c->cipher_data);\n#ifndef OPENSSL_NO_ENGINE\n    if (c->engine)\n        ENGINE_finish(c->engine);\n#endif\n    memset(c, 0, sizeof(*c));\n    return 1;\n}', 'void CRYPTO_free(void *str)\n{\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']