crypto/bn/bn_mont.c:507: error: USE_AFTER_FREE
  call to `CRYPTO_lock()` eventually accesses memory that was invalidated by call to `free()` on line 505 indirectly during the call to `CRYPTO_lock()`.
Showing all 22 steps of the trace


crypto/bn/bn_mont.c:505:5: invalidation part of the trace starts here
503.       BN_MONT_CTX *ret;
504.   
505.       CRYPTO_r_lock(lock);
           ^
506.       ret = *pmont;
507.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:505:5: global variable `dyn_locks` accessed here
  503.       BN_MONT_CTX *ret;
  504.   
  505.       CRYPTO_r_lock(lock);
             ^
  506.       ret = *pmont;
  507.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:505:5: when calling `CRYPTO_lock` here
  503.       BN_MONT_CTX *ret;
  504.   
  505.       CRYPTO_r_lock(lock);
             ^
  506.       ret = *pmont;
  507.       CRYPTO_r_unlock(lock);

crypto/lock.c:444:19: global variable `dyn_locks` accessed here
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer
    444.                   = CRYPTO_get_dynlock_value(type);
                             ^
    445.   
    446.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:450:13: when calling `CRYPTO_destroy_dynlockid` here
    448.               dynlock_lock_callback(mode, pointer, file, line);
    449.   
    450.               CRYPTO_destroy_dynlockid(type);
                       ^
    451.           }
    452.       } else if (locking_callback != NULL)

crypto/lock.c:301:9: global variable `dyn_locks` accessed here
      299.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      300.   
      301.       if (dyn_locks == NULL || i >= sk_CRYPTO_dynlock_num(dyn_locks)) {
                     ^
      302.           CRYPTO_w_unlock(CRYPTO_LOCK_DYNLOCK);
      303.           return;

crypto/lock.c:305:15: passed as argument to `sk_CRYPTO_dynlock_value`
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:305:15: return from call to `sk_CRYPTO_dynlock_value`
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:305:5: assigned
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                 ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:323:9: when calling `CRYPTO_free` here
      321.       if (pointer) {
      322.           dynlock_destroy_callback(pointer->data, __FILE__, __LINE__);
      323.           OPENSSL_free(pointer);
                     ^
      324.       }
      325.   }

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
        232.   }
        233.   
        234. > void CRYPTO_free(void *str)
        235.   {
        236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: was invalidated by call to `free()`
        243.       }
        244.   #else
        245.       free(str);
                   ^
        246.   #endif
        247.   }

crypto/bn/bn_mont.c:505:5: use-after-lifetime part of the trace starts here
503.       BN_MONT_CTX *ret;
504.   
505.       CRYPTO_r_lock(lock);
           ^
506.       ret = *pmont;
507.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:505:5: global variable `dyn_locks` accessed here
  503.       BN_MONT_CTX *ret;
  504.   
  505.       CRYPTO_r_lock(lock);
             ^
  506.       ret = *pmont;
  507.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:507:5: when calling `CRYPTO_lock` here
  505.       CRYPTO_r_lock(lock);
  506.       ret = *pmont;
  507.       CRYPTO_r_unlock(lock);
             ^
  508.       if (ret)
  509.           return ret;

crypto/lock.c:444:19: global variable `dyn_locks` accessed here
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer
    444.                   = CRYPTO_get_dynlock_value(type);
                             ^
    445.   
    446.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:444:19: when calling `CRYPTO_get_dynlock_value` here
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer
    444.                   = CRYPTO_get_dynlock_value(type);
                             ^
    445.   
    446.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:335:9: global variable `dyn_locks` accessed here
      333.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      334.   
      335.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
                     ^
      336.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
      337.       if (pointer)

crypto/lock.c:336:19: passed as argument to `sk_CRYPTO_dynlock_value`
      334.   
      335.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      336.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                               ^
      337.       if (pointer)
      338.           pointer->references++;

crypto/lock.c:336:19: return from call to `sk_CRYPTO_dynlock_value`
      334.   
      335.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      336.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                               ^
      337.       if (pointer)
      338.           pointer->references++;

crypto/lock.c:336:9: assigned
      334.   
      335.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      336.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                     ^
      337.       if (pointer)
      338.           pointer->references++;

crypto/lock.c:343:16: invalid access occurs here
      341.   
      342.       if (pointer)
      343.           return pointer->data;
                            ^
      344.       return NULL;
      345.   }
