crypto/hmac/hmac.c:199: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_free()` eventually accesses memory that was invalidated by call to `free()` on line 198 indirectly during the call to `hmac_ctx_cleanup()`.
Showing all 16 steps of the trace


crypto/hmac/hmac.c:195:1: invalidation part of the trace starts here
193.   }
194.   
195. > void HMAC_CTX_free(HMAC_CTX *ctx)
196.   {
197.       if (ctx != NULL) {

crypto/hmac/hmac.c:195:1: parameter `ctx` of HMAC_CTX_free
  193.   }
  194.   
  195. > void HMAC_CTX_free(HMAC_CTX *ctx)
  196.   {
  197.       if (ctx != NULL) {

crypto/hmac/hmac.c:198:9: when calling `hmac_ctx_cleanup` here
  196.   {
  197.       if (ctx != NULL) {
  198.           hmac_ctx_cleanup(ctx);
                 ^
  199.           EVP_MD_CTX_free(ctx->i_ctx);
  200.           EVP_MD_CTX_free(ctx->o_ctx);

crypto/hmac/hmac.c:185:1: parameter `ctx` of hmac_ctx_cleanup
    183.   }
    184.   
    185. > static void hmac_ctx_cleanup(HMAC_CTX *ctx)
    186.   {
    187.       EVP_MD_CTX_reset(ctx->i_ctx);

crypto/hmac/hmac.c:187:5: when calling `EVP_MD_CTX_reset` here
    185.   static void hmac_ctx_cleanup(HMAC_CTX *ctx)
    186.   {
    187.       EVP_MD_CTX_reset(ctx->i_ctx);
               ^
    188.       EVP_MD_CTX_reset(ctx->o_ctx);
    189.       EVP_MD_CTX_reset(ctx->md_ctx);

crypto/evp/digest.c:122:1: parameter `ctx` of EVP_MD_CTX_reset
      120.   
      121.   /* This call frees resources associated with the context */
      122. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
      123.   {
      124.       if (ctx == NULL)

crypto/evp/digest.c:138:5: when calling `EVP_PKEY_CTX_free` here
      136.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
      137.       }
      138.       EVP_PKEY_CTX_free(ctx->pctx);
                 ^
      139.   #ifndef OPENSSL_NO_ENGINE
      140.       if (ctx->engine)

crypto/evp/pmeth_lib.c:323:1: parameter `ctx` of EVP_PKEY_CTX_free
        321.   }
        322.   
        323. > void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)
        324.   {
        325.       if (ctx == NULL)

crypto/evp/pmeth_lib.c:339:5: when calling `CRYPTO_free` here
        337.           ENGINE_finish(ctx->engine);
        338.   #endif
        339.       OPENSSL_free(ctx);
                   ^
        340.   }
        341.   

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
          208.   }
          209.   
          210. > void CRYPTO_free(void *str, const char *file, int line)
          211.   {
          212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: was invalidated by call to `free()`
          224.       }
          225.   #else
          226.       free(str);
                     ^
          227.   #endif
          228.   }

crypto/hmac/hmac.c:195:1: use-after-lifetime part of the trace starts here
193.   }
194.   
195. > void HMAC_CTX_free(HMAC_CTX *ctx)
196.   {
197.       if (ctx != NULL) {

crypto/hmac/hmac.c:195:1: parameter `ctx` of HMAC_CTX_free
  193.   }
  194.   
  195. > void HMAC_CTX_free(HMAC_CTX *ctx)
  196.   {
  197.       if (ctx != NULL) {

crypto/hmac/hmac.c:199:9: when calling `EVP_MD_CTX_free` here
  197.       if (ctx != NULL) {
  198.           hmac_ctx_cleanup(ctx);
  199.           EVP_MD_CTX_free(ctx->i_ctx);
                 ^
  200.           EVP_MD_CTX_free(ctx->o_ctx);
  201.           EVP_MD_CTX_free(ctx->md_ctx);

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
    208.   }
    209.   
    210. > void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: invalid access occurs here
    224.       }
    225.   #else
    226.       free(str);
               ^
    227.   #endif
    228.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['void HMAC_CTX_free(HMAC_CTX *ctx)\n{\n    if (ctx != NULL) {\n        hmac_ctx_cleanup(ctx);\n        EVP_MD_CTX_free(ctx->i_ctx);\n        EVP_MD_CTX_free(ctx->o_ctx);\n        EVP_MD_CTX_free(ctx->md_ctx);\n        OPENSSL_free(ctx);\n    }\n}', 'static void hmac_ctx_cleanup(HMAC_CTX *ctx)\n{\n    EVP_MD_CTX_reset(ctx->i_ctx);\n    EVP_MD_CTX_reset(ctx->o_ctx);\n    EVP_MD_CTX_reset(ctx->md_ctx);\n    ctx->md = NULL;\n    ctx->key_length = 0;\n    memset(ctx->key, 0, sizeof(HMAC_MAX_MD_CBLOCK));\n}', 'int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)\n{\n    if (ctx == NULL)\n        return 1;\n    if (ctx->digest && ctx->digest->cleanup\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_CLEANED))\n        ctx->digest->cleanup(ctx);\n    if (ctx->digest && ctx->digest->ctx_size && ctx->md_data\n        && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {\n        OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);\n    }\n    EVP_PKEY_CTX_free(ctx->pctx);\n#ifndef OPENSSL_NO_ENGINE\n    if (ctx->engine)\n        ENGINE_finish(ctx->engine);\n#endif\n    memset(ctx, 0, sizeof(*ctx));\n    return 1;\n}', 'void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)\n{\n    if (ctx == NULL)\n        return;\n    if (ctx->pmeth && ctx->pmeth->cleanup)\n        ctx->pmeth->cleanup(ctx);\n    EVP_PKEY_free(ctx->pkey);\n    EVP_PKEY_free(ctx->peerkey);\n#ifndef OPENSSL_NO_ENGINE\n    if (ctx->engine)\n        ENGINE_finish(ctx->engine);\n#endif\n    OPENSSL_free(ctx);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']