crypto/evp/m_sigver.c:148: error: USE_AFTER_FREE
  call to `EVP_PKEY_sign()` eventually accesses memory that was invalidated by call to `free()` on line 130 indirectly during the call to `EVP_DigestFinal_ex()`.
Showing all 16 steps of the trace


crypto/evp/m_sigver.c:100:1: invalidation part of the trace starts here
98.   }
99.   
100. > int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret,
101.                           size_t *siglen)
102.   {

crypto/evp/m_sigver.c:100:1: parameter `ctx` of EVP_DigestSignFinal
  98.   }
  99.   
  100. > int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret,
  101.                           size_t *siglen)
  102.   {

crypto/evp/m_sigver.c:130:21: when calling `EVP_DigestFinal_ex` here
  128.                   r = ctx->pctx->pmeth->signctx(ctx->pctx, sigret, siglen, ctx);
  129.               else
  130.                   r = EVP_DigestFinal_ex(ctx, md, &mdlen);
                             ^
  131.           } else {
  132.               EVP_MD_CTX *tmp_ctx = EVP_MD_CTX_new();

crypto/evp/digest.c:286:1: parameter `ctx` of EVP_DigestFinal_ex
    284.   
    285.   /* The caller can assume that this removes any secret data from the context */
    286. > int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *isize)
    287.   {
    288.       int ret;

crypto/evp/digest.c:310:5: when calling `EVP_MD_CTX_reset` here
    308.       }
    309.   
    310.       EVP_MD_CTX_reset(ctx);
               ^
    311.   
    312.       return ret;

crypto/evp/digest.c:20:1: parameter `ctx` of EVP_MD_CTX_reset
      18.   
      19.   /* This call frees resources associated with the context */
      20. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
      21.   {
      22.       if (ctx == NULL)

crypto/evp/digest.c:59:9: when calling `EVP_PKEY_CTX_free` here
      57.        */
      58.       if (!EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX))
      59.           EVP_PKEY_CTX_free(ctx->pctx);
                    ^
      60.   #ifndef OPENSSL_NO_ENGINE
      61.       ENGINE_finish(ctx->engine);

crypto/evp/pmeth_lib.c:352:1: parameter `ctx` of EVP_PKEY_CTX_free
        350.   }
        351.   
        352. > void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)
        353.   {
        354.       if (ctx == NULL)

crypto/evp/pmeth_lib.c:363:5: when calling `CRYPTO_free` here
        361.       ENGINE_finish(ctx->engine);
        362.   #endif
        363.       OPENSSL_free(ctx);
                   ^
        364.   }
        365.   

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
          293.   }
          294.   
          295. > void CRYPTO_free(void *str, const char *file, int line)
          296.   {
          297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
          310.       }
          311.   #else
          312.       free(str);
                     ^
          313.   #endif
          314.   }

crypto/evp/m_sigver.c:100:1: use-after-lifetime part of the trace starts here
98.   }
99.   
100. > int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret,
101.                           size_t *siglen)
102.   {

crypto/evp/m_sigver.c:100:1: parameter `ctx` of EVP_DigestSignFinal
  98.   }
  99.   
  100. > int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret,
  101.                           size_t *siglen)
  102.   {

crypto/evp/m_sigver.c:148:13: when calling `EVP_PKEY_sign` here
  146.           if (sctx || !r)
  147.               return r;
  148.           if (EVP_PKEY_sign(ctx->pctx, sigret, siglen, md, mdlen) <= 0)
                     ^
  149.               return 0;
  150.       } else {

crypto/evp/pmeth_fn.c:52:1: parameter `ctx` of EVP_PKEY_sign
    50.   }
    51.   
    52. > int EVP_PKEY_sign(EVP_PKEY_CTX *ctx,
    53.                     unsigned char *sig, size_t *siglen,
    54.                     const unsigned char *tbs, size_t tbslen)

crypto/evp/pmeth_fn.c:65:5: invalid access occurs here
    63.           return -1;
    64.       }
    65.       M_check_autoarg(ctx, sig, siglen, EVP_F_EVP_PKEY_SIGN)
              ^
    66.           return ctx->pmeth->sign(ctx, sig, siglen, tbs, tbslen);
    67.   }
