crypto/evp/evp_key.c:110: error: USE_AFTER_FREE
  call to `EVP_DigestInit_ex()` eventually accesses memory that was invalidated by call to `free()` on line 106 indirectly during the call to `EVP_DigestFinal_ex()`.
Showing all 22 steps of the trace


crypto/evp/evp_key.c:92:9: invalidation part of the trace starts here
90.           return nkey;
91.   
92.       c = EVP_MD_CTX_new();
              ^
93.       if (c == NULL)
94.           goto err;

crypto/evp/evp_key.c:92:9: passed as argument to `EVP_MD_CTX_new`
  90.           return nkey;
  91.   
  92.       c = EVP_MD_CTX_new();
                ^
  93.       if (c == NULL)
  94.           goto err;

crypto/evp/evp_key.c:92:9: return from call to `EVP_MD_CTX_new`
  90.           return nkey;
  91.   
  92.       c = EVP_MD_CTX_new();
                ^
  93.       if (c == NULL)
  94.           goto err;

crypto/evp/evp_key.c:92:5: assigned
  90.           return nkey;
  91.   
  92.       c = EVP_MD_CTX_new();
            ^
  93.       if (c == NULL)
  94.           goto err;

crypto/evp/evp_key.c:106:14: when calling `EVP_DigestFinal_ex` here
  104.               if (!EVP_DigestUpdate(c, salt, PKCS5_SALT_LEN))
  105.                   goto err;
  106.           if (!EVP_DigestFinal_ex(c, &(md_buf[0]), &mds))
                      ^
  107.               goto err;
  108.   

crypto/evp/digest.c:286:1: parameter `ctx` of EVP_DigestFinal_ex
    284.   
    285.   /* The caller can assume that this removes any secret data from the context */
    286. > int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *isize)
    287.   {
    288.       int ret;

crypto/evp/digest.c:310:5: when calling `EVP_MD_CTX_reset` here
    308.       }
    309.   
    310.       EVP_MD_CTX_reset(ctx);
               ^
    311.   
    312.       return ret;

crypto/evp/digest.c:20:1: parameter `ctx` of EVP_MD_CTX_reset
      18.   
      19.   /* This call frees resources associated with the context */
      20. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
      21.   {
      22.       if (ctx == NULL)

crypto/evp/digest.c:59:9: when calling `EVP_PKEY_CTX_free` here
      57.        */
      58.       if (!EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX))
      59.           EVP_PKEY_CTX_free(ctx->pctx);
                    ^
      60.   #ifndef OPENSSL_NO_ENGINE
      61.       ENGINE_finish(ctx->engine);

crypto/evp/pmeth_lib.c:352:1: parameter `ctx` of EVP_PKEY_CTX_free
        350.   }
        351.   
        352. > void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)
        353.   {
        354.       if (ctx == NULL)

crypto/evp/pmeth_lib.c:363:5: when calling `CRYPTO_free` here
        361.       ENGINE_finish(ctx->engine);
        362.   #endif
        363.       OPENSSL_free(ctx);
                   ^
        364.   }
        365.   

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
          293.   }
          294.   
          295. > void CRYPTO_free(void *str, const char *file, int line)
          296.   {
          297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
          310.       }
          311.   #else
          312.       free(str);
                     ^
          313.   #endif
          314.   }

crypto/evp/evp_key.c:92:9: use-after-lifetime part of the trace starts here
90.           return nkey;
91.   
92.       c = EVP_MD_CTX_new();
              ^
93.       if (c == NULL)
94.           goto err;

crypto/evp/evp_key.c:92:9: passed as argument to `EVP_MD_CTX_new`
  90.           return nkey;
  91.   
  92.       c = EVP_MD_CTX_new();
                ^
  93.       if (c == NULL)
  94.           goto err;

crypto/evp/evp_key.c:92:9: return from call to `EVP_MD_CTX_new`
  90.           return nkey;
  91.   
  92.       c = EVP_MD_CTX_new();
                ^
  93.       if (c == NULL)
  94.           goto err;

crypto/evp/evp_key.c:92:5: assigned
  90.           return nkey;
  91.   
  92.       c = EVP_MD_CTX_new();
            ^
  93.       if (c == NULL)
  94.           goto err;

crypto/evp/evp_key.c:110:18: when calling `EVP_DigestInit_ex` here
  108.   
  109.           for (i = 1; i < (unsigned int)count; i++) {
  110.               if (!EVP_DigestInit_ex(c, md, NULL))
                          ^
  111.                   goto err;
  112.               if (!EVP_DigestUpdate(c, &(md_buf[0]), mds))

crypto/evp/digest.c:102:1: parameter `ctx` of EVP_DigestInit_ex
    100.   }
    101.   
    102. > int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
    103.   {
    104.       EVP_MD *provmd;

crypto/evp/digest.c:250:13: when calling `EVP_PKEY_CTX_ctrl` here
    248.       if (ctx->pctx) {
    249.           int r;
    250.           r = EVP_PKEY_CTX_ctrl(ctx->pctx, -1, EVP_PKEY_OP_TYPE_SIG,
                       ^
    251.                                 EVP_PKEY_CTRL_DIGESTINIT, 0, ctx);
    252.           if (r <= 0 && (r != -2))

crypto/evp/pmeth_lib.c:366:1: parameter `ctx` of EVP_PKEY_CTX_ctrl
      364.   }
      365.   
      366. > int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype,
      367.                         int cmd, int p1, void *p2)
      368.   {

crypto/evp/pmeth_lib.c:393:11: invalid access occurs here
      391.   
      392.    doit:
      393.       ret = ctx->pmeth->ctrl(ctx, cmd, p1, p2);
                       ^
      394.   
      395.       if (ret == -2)
