crypto/hmac/hmac.c:232: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_copy_ex()` eventually accesses memory that was invalidated by call to `free()` on line 230 indirectly during the call to `HMAC_CTX_reset()`.
Showing all 20 steps of the trace


crypto/hmac/hmac.c:228:1: invalidation part of the trace starts here
226.   }
227.   
228. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
229.   {
230.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:228:1: parameter `dctx` of HMAC_CTX_copy
  226.   }
  227.   
  228. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
  229.   {
  230.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:230:10: when calling `HMAC_CTX_reset` here
  228.   int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
  229.   {
  230.       if (!HMAC_CTX_reset(dctx))
                  ^
  231.           goto err;
  232.       if (!EVP_MD_CTX_copy_ex(dctx->i_ctx, sctx->i_ctx))

crypto/hmac/hmac.c:206:1: parameter `ctx` of HMAC_CTX_reset
    204.   }
    205.   
    206. > int HMAC_CTX_reset(HMAC_CTX *ctx)
    207.   {
    208.       hmac_ctx_cleanup(ctx);

crypto/hmac/hmac.c:208:5: when calling `hmac_ctx_cleanup` here
    206.   int HMAC_CTX_reset(HMAC_CTX *ctx)
    207.   {
    208.       hmac_ctx_cleanup(ctx);
               ^
    209.       if (ctx->i_ctx == NULL)
    210.           ctx->i_ctx = EVP_MD_CTX_new();

crypto/hmac/hmac.c:185:1: parameter `ctx` of hmac_ctx_cleanup
      183.   }
      184.   
      185. > static void hmac_ctx_cleanup(HMAC_CTX *ctx)
      186.   {
      187.       EVP_MD_CTX_reset(ctx->i_ctx);

crypto/hmac/hmac.c:187:5: when calling `EVP_MD_CTX_reset` here
      185.   static void hmac_ctx_cleanup(HMAC_CTX *ctx)
      186.   {
      187.       EVP_MD_CTX_reset(ctx->i_ctx);
                 ^
      188.       EVP_MD_CTX_reset(ctx->o_ctx);
      189.       EVP_MD_CTX_reset(ctx->md_ctx);

crypto/evp/digest.c:122:1: parameter `ctx` of EVP_MD_CTX_reset
        120.   
        121.   /* This call frees resources associated with the context */
        122. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
        123.   {
        124.       if (ctx == NULL)

crypto/evp/digest.c:138:5: when calling `EVP_PKEY_CTX_free` here
        136.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
        137.       }
        138.       EVP_PKEY_CTX_free(ctx->pctx);
                   ^
        139.   #ifndef OPENSSL_NO_ENGINE
        140.       ENGINE_finish(ctx->engine);

crypto/evp/pmeth_lib.c:322:1: parameter `ctx` of EVP_PKEY_CTX_free
          320.   }
          321.   
          322. > void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)
          323.   {
          324.       if (ctx == NULL)

crypto/evp/pmeth_lib.c:329:5: when calling `EVP_PKEY_free` here
          327.           ctx->pmeth->cleanup(ctx);
          328.       EVP_PKEY_free(ctx->pkey);
          329.       EVP_PKEY_free(ctx->peerkey);
                     ^
          330.   #ifndef OPENSSL_NO_ENGINE
          331.       ENGINE_finish(ctx->engine);

crypto/evp/p_lib.c:412:1: parameter `x` of EVP_PKEY_free
            410.   }
            411.   
            412. > void EVP_PKEY_free(EVP_PKEY *x)
            413.   {
            414.       int i;

crypto/evp/p_lib.c:426:5: when calling `CRYPTO_free` here
            424.       EVP_PKEY_free_it(x);
            425.       sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
            426.       OPENSSL_free(x);
                       ^
            427.   }
            428.   

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
              208.   }
              209.   
              210. > void CRYPTO_free(void *str, const char *file, int line)
              211.   {
              212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: was invalidated by call to `free()`
              224.       }
              225.   #else
              226.       free(str);
                         ^
              227.   #endif
              228.   }

crypto/hmac/hmac.c:228:1: use-after-lifetime part of the trace starts here
226.   }
227.   
228. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
229.   {
230.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:228:1: parameter `dctx` of HMAC_CTX_copy
  226.   }
  227.   
  228. > int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
  229.   {
  230.       if (!HMAC_CTX_reset(dctx))

crypto/hmac/hmac.c:232:10: when calling `EVP_MD_CTX_copy_ex` here
  230.       if (!HMAC_CTX_reset(dctx))
  231.           goto err;
  232.       if (!EVP_MD_CTX_copy_ex(dctx->i_ctx, sctx->i_ctx))
                  ^
  233.           goto err;
  234.       if (!EVP_MD_CTX_copy_ex(dctx->o_ctx, sctx->o_ctx))

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
    208.   }
    209.   
    210. > void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: invalid access occurs here
    224.       }
    225.   #else
    226.       free(str);
               ^
    227.   #endif
    228.   }
