ssl/s3_enc.c:328: error: USE_AFTER_FREE
  call to `EVP_CipherInit_ex()` eventually accesses memory that was invalidated by call to `free()` on line 237 indirectly during the call to `EVP_CIPHER_CTX_reset()`.
Showing all 16 steps of the trace


ssl/s3_enc.c:231:37: invalidation part of the trace starts here
229.           if (s->enc_read_ctx != NULL)
230.               reuse_dd = 1;
231.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                           ^
232.               goto err;
233.           else

ssl/s3_enc.c:231:37: passed as argument to `EVP_CIPHER_CTX_new`
  229.           if (s->enc_read_ctx != NULL)
  230.               reuse_dd = 1;
  231.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  232.               goto err;
  233.           else

ssl/s3_enc.c:231:37: return from call to `EVP_CIPHER_CTX_new`
  229.           if (s->enc_read_ctx != NULL)
  230.               reuse_dd = 1;
  231.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  232.               goto err;
  233.           else

ssl/s3_enc.c:231:19: assigned
  229.           if (s->enc_read_ctx != NULL)
  230.               reuse_dd = 1;
  231.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                           ^
  232.               goto err;
  233.           else

ssl/s3_enc.c:237:13: when calling `EVP_CIPHER_CTX_reset` here
  235.                * make sure it's intialized in case we exit later with an error
  236.                */
  237.               EVP_CIPHER_CTX_reset(s->enc_read_ctx);
                     ^
  238.           dd = s->enc_read_ctx;
  239.   

crypto/evp/evp_enc.c:69:1: parameter `c` of EVP_CIPHER_CTX_reset
    67.   #include "evp_locl.h"
    68.   
    69. > int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
    70.   {
    71.       if (c == NULL)

crypto/evp/evp_enc.c:80:5: when calling `CRYPTO_free` here
    78.               OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);
    79.       }
    80.       OPENSSL_free(c->cipher_data);
              ^
    81.   #ifndef OPENSSL_NO_ENGINE
    82.       if (c->engine)

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
      232.   }
      233.   
      234. > void CRYPTO_free(void *str)
      235.   {
      236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: was invalidated by call to `free()`
      243.       }
      244.   #else
      245.       free(str);
                 ^
      246.   #endif
      247.   }

ssl/s3_enc.c:231:37: use-after-lifetime part of the trace starts here
229.           if (s->enc_read_ctx != NULL)
230.               reuse_dd = 1;
231.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                           ^
232.               goto err;
233.           else

ssl/s3_enc.c:231:37: passed as argument to `EVP_CIPHER_CTX_new`
  229.           if (s->enc_read_ctx != NULL)
  230.               reuse_dd = 1;
  231.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  232.               goto err;
  233.           else

ssl/s3_enc.c:231:37: return from call to `EVP_CIPHER_CTX_new`
  229.           if (s->enc_read_ctx != NULL)
  230.               reuse_dd = 1;
  231.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  232.               goto err;
  233.           else

ssl/s3_enc.c:231:19: assigned
  229.           if (s->enc_read_ctx != NULL)
  230.               reuse_dd = 1;
  231.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                           ^
  232.               goto err;
  233.           else

ssl/s3_enc.c:328:5: when calling `EVP_CipherInit_ex` here
  326.       memcpy(mac_secret, ms, i);
  327.   
  328.       EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE));
             ^
  329.   
  330.   #ifdef OPENSSL_SSL_TRACE_CRYPTO

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
    232.   }
    233.   
    234. > void CRYPTO_free(void *str)
    235.   {
    236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: invalid access occurs here
    243.       }
    244.   #else
    245.       free(str);
               ^
    246.   #endif
    247.   }
