crypto/hmac/hmac.c:231: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_copy_ex()` eventually accesses memory that was invalidated by call to `free()` on line 229 indirectly during the call to `HMAC_CTX_reset()`.
Showing all 18 steps of the trace


crypto/hmac/hmac.c:227:1: invalidation part of the trace starts here
225.   }
226.   
227. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
228.   {
229.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:227:1: parameter `dctx` of HMAC_CTX_copy
  225.   }
  226.   
  227. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
  228.   {
  229.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:229:10: when calling `HMAC_CTX_reset` here
  227.   int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
  228.   {
  229.       if (!HMAC_CTX_reset(dctx))
                  ^
  230.           goto err;
  231.       if (!EVP_MD_CTX_copy_ex(dctx->i_ctx, sctx->i_ctx))

crypto/hmac/hmac.c:205:1: parameter `ctx` of HMAC_CTX_reset
    203.   }
    204.   
    205. > int HMAC_CTX_reset(HMAC_CTX *ctx)
    206.   {
    207.       hmac_ctx_cleanup(ctx);

crypto/hmac/hmac.c:207:5: when calling `hmac_ctx_cleanup` here
    205.   int HMAC_CTX_reset(HMAC_CTX *ctx)
    206.   {
    207.       hmac_ctx_cleanup(ctx);
               ^
    208.       if (ctx->i_ctx == NULL)
    209.           ctx->i_ctx = EVP_MD_CTX_new();

crypto/hmac/hmac.c:184:1: parameter `ctx` of hmac_ctx_cleanup
      182.   }
      183.   
      184. > static void hmac_ctx_cleanup(HMAC_CTX *ctx)
      185.   {
      186.       EVP_MD_CTX_reset(ctx->i_ctx);

crypto/hmac/hmac.c:186:5: when calling `EVP_MD_CTX_reset` here
      184.   static void hmac_ctx_cleanup(HMAC_CTX *ctx)
      185.   {
      186.       EVP_MD_CTX_reset(ctx->i_ctx);
                 ^
      187.       EVP_MD_CTX_reset(ctx->o_ctx);
      188.       EVP_MD_CTX_reset(ctx->md_ctx);

crypto/evp/digest.c:123:1: parameter `ctx` of EVP_MD_CTX_reset
        121.   
        122.   /* This call frees resources associated with the context */
        123. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
        124.   {
        125.       if (ctx == NULL)

crypto/evp/digest.c:137:9: when calling `CRYPTO_clear_free` here
        135.       if (ctx->digest && ctx->digest->ctx_size && ctx->md_data
        136.           && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {
        137.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
                       ^
        138.       }
        139.       EVP_PKEY_CTX_free(ctx->pctx);

crypto/mem.c:249:1: parameter `str` of CRYPTO_clear_free
          247.   }
          248.   
          249. > void CRYPTO_clear_free(void *str, size_t num)
          250.   {
          251.       if (str == NULL)

crypto/mem.c:255:5: when calling `CRYPTO_free` here
          253.       if (num)
          254.           OPENSSL_cleanse(str, num);
          255.       CRYPTO_free(str);
                     ^
          256.   }

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
            232.   }
            233.   
            234. > void CRYPTO_free(void *str)
            235.   {
            236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: was invalidated by call to `free()`
            243.       }
            244.   #else
            245.       free(str);
                       ^
            246.   #endif
            247.   }

crypto/hmac/hmac.c:227:1: use-after-lifetime part of the trace starts here
225.   }
226.   
227. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
228.   {
229.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:227:1: parameter `dctx` of HMAC_CTX_copy
  225.   }
  226.   
  227. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
  228.   {
  229.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:231:10: when calling `EVP_MD_CTX_copy_ex` here
  229.       if (!HMAC_CTX_reset(dctx))
  230.           goto err;
  231.       if (!EVP_MD_CTX_copy_ex(dctx->i_ctx, sctx->i_ctx))
                  ^
  232.           goto err;
  233.       if (!EVP_MD_CTX_copy_ex(dctx->o_ctx, sctx->o_ctx))

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
    232.   }
    233.   
    234. > void CRYPTO_free(void *str)
    235.   {
    236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: invalid access occurs here
    243.       }
    244.   #else
    245.       free(str);
               ^
    246.   #endif
    247.   }
