ssl/t1_enc.c:397: error: USE_AFTER_FREE
  call to `EVP_CipherInit_ex()` eventually accesses memory that was invalidated by call to `free()` on line 316 indirectly during the call to `EVP_CIPHER_CTX_reset()`.
Showing all 14 steps of the trace


ssl/t1_enc.c:206:1: invalidation part of the trace starts here
204.   }
205.   
206. > int tls1_change_cipher_state(SSL *s, int which)
207.   {
208.       unsigned char *p, *mac_secret;

ssl/t1_enc.c:206:1: parameter `s` of tls1_change_cipher_state
  204.   }
  205.   
  206. > int tls1_change_cipher_state(SSL *s, int which)
  207.   {
  208.       unsigned char *p, *mac_secret;

ssl/t1_enc.c:283:9: assigned
  281.           else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)
  282.               goto err;
  283.           dd = s->enc_write_ctx;
                 ^
  284.           if (SSL_IS_DTLS(s)) {
  285.               mac_ctx = EVP_MD_CTX_new();

ssl/t1_enc.c:316:9: when calling `EVP_CIPHER_CTX_reset` here
  314.   
  315.       if (reuse_dd)
  316.           EVP_CIPHER_CTX_reset(dd);
                 ^
  317.   
  318.       p = s->s3->tmp.key_block;

crypto/evp/evp_enc.c:69:1: parameter `c` of EVP_CIPHER_CTX_reset
    67.   #include "evp_locl.h"
    68.   
    69. > int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
    70.   {
    71.       if (c == NULL)

crypto/evp/evp_enc.c:80:5: when calling `CRYPTO_free` here
    78.               OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);
    79.       }
    80.       OPENSSL_free(c->cipher_data);
              ^
    81.   #ifndef OPENSSL_NO_ENGINE
    82.       if (c->engine)

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }

ssl/t1_enc.c:206:1: use-after-lifetime part of the trace starts here
204.   }
205.   
206. > int tls1_change_cipher_state(SSL *s, int which)
207.   {
208.       unsigned char *p, *mac_secret;

ssl/t1_enc.c:206:1: parameter `s` of tls1_change_cipher_state
  204.   }
  205.   
  206. > int tls1_change_cipher_state(SSL *s, int which)
  207.   {
  208.       unsigned char *p, *mac_secret;

ssl/t1_enc.c:283:9: assigned
  281.           else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)
  282.               goto err;
  283.           dd = s->enc_write_ctx;
                 ^
  284.           if (SSL_IS_DTLS(s)) {
  285.               mac_ctx = EVP_MD_CTX_new();

ssl/t1_enc.c:397:14: when calling `EVP_CipherInit_ex` here
  395.           }
  396.       } else {
  397.           if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) {
                      ^
  398.               SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
  399.               goto err2;

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }
