crypto/bn/bn_mont.c:506: error: USE_AFTER_FREE
  call to `CRYPTO_lock()` eventually accesses memory that was invalidated by call to `free()` on line 504 indirectly during the call to `CRYPTO_lock()`.
Showing all 22 steps of the trace


crypto/bn/bn_mont.c:504:5: invalidation part of the trace starts here
502.       BN_MONT_CTX *ret;
503.   
504.       CRYPTO_r_lock(lock);
           ^
505.       ret = *pmont;
506.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:504:5: global variable `dyn_locks` accessed here
  502.       BN_MONT_CTX *ret;
  503.   
  504.       CRYPTO_r_lock(lock);
             ^
  505.       ret = *pmont;
  506.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:504:5: when calling `CRYPTO_lock` here
  502.       BN_MONT_CTX *ret;
  503.   
  504.       CRYPTO_r_lock(lock);
             ^
  505.       ret = *pmont;
  506.       CRYPTO_r_unlock(lock);

crypto/lock.c:443:19: global variable `dyn_locks` accessed here
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer
    443.                   = CRYPTO_get_dynlock_value(type);
                             ^
    444.   
    445.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:449:13: when calling `CRYPTO_destroy_dynlockid` here
    447.               dynlock_lock_callback(mode, pointer, file, line);
    448.   
    449.               CRYPTO_destroy_dynlockid(type);
                       ^
    450.           }
    451.       } else if (locking_callback != NULL)

crypto/lock.c:300:9: global variable `dyn_locks` accessed here
      298.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      299.   
      300.       if (dyn_locks == NULL || i >= sk_CRYPTO_dynlock_num(dyn_locks)) {
                     ^
      301.           CRYPTO_w_unlock(CRYPTO_LOCK_DYNLOCK);
      302.           return;

crypto/lock.c:304:15: passed as argument to `sk_CRYPTO_dynlock_value`
      302.           return;
      303.       }
      304.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      305.       if (pointer != NULL) {
      306.           --pointer->references;

crypto/lock.c:304:15: return from call to `sk_CRYPTO_dynlock_value`
      302.           return;
      303.       }
      304.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      305.       if (pointer != NULL) {
      306.           --pointer->references;

crypto/lock.c:304:5: assigned
      302.           return;
      303.       }
      304.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                 ^
      305.       if (pointer != NULL) {
      306.           --pointer->references;

crypto/lock.c:322:9: when calling `CRYPTO_free` here
      320.       if (pointer) {
      321.           dynlock_destroy_callback(pointer->data, __FILE__, __LINE__);
      322.           OPENSSL_free(pointer);
                     ^
      323.       }
      324.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
        231.   }
        232.   
        233. > void CRYPTO_free(void *str)
        234.   {
        235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
        242.       }
        243.   #else
        244.       free(str);
                   ^
        245.   #endif
        246.   }

crypto/bn/bn_mont.c:504:5: use-after-lifetime part of the trace starts here
502.       BN_MONT_CTX *ret;
503.   
504.       CRYPTO_r_lock(lock);
           ^
505.       ret = *pmont;
506.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:504:5: global variable `dyn_locks` accessed here
  502.       BN_MONT_CTX *ret;
  503.   
  504.       CRYPTO_r_lock(lock);
             ^
  505.       ret = *pmont;
  506.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:506:5: when calling `CRYPTO_lock` here
  504.       CRYPTO_r_lock(lock);
  505.       ret = *pmont;
  506.       CRYPTO_r_unlock(lock);
             ^
  507.       if (ret)
  508.           return ret;

crypto/lock.c:443:19: global variable `dyn_locks` accessed here
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer
    443.                   = CRYPTO_get_dynlock_value(type);
                             ^
    444.   
    445.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:443:19: when calling `CRYPTO_get_dynlock_value` here
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer
    443.                   = CRYPTO_get_dynlock_value(type);
                             ^
    444.   
    445.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:334:9: global variable `dyn_locks` accessed here
      332.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      333.   
      334.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
                     ^
      335.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
      336.       if (pointer)

crypto/lock.c:335:19: passed as argument to `sk_CRYPTO_dynlock_value`
      333.   
      334.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      335.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                               ^
      336.       if (pointer)
      337.           pointer->references++;

crypto/lock.c:335:19: return from call to `sk_CRYPTO_dynlock_value`
      333.   
      334.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      335.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                               ^
      336.       if (pointer)
      337.           pointer->references++;

crypto/lock.c:335:9: assigned
      333.   
      334.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      335.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                     ^
      336.       if (pointer)
      337.           pointer->references++;

crypto/lock.c:342:16: invalid access occurs here
      340.   
      341.       if (pointer)
      342.           return pointer->data;
                            ^
      343.       return NULL;
      344.   }
