crypto/bn/bn_mont.c:506: error: USE_AFTER_FREE
  call to `CRYPTO_lock()` eventually accesses memory that was invalidated by call to `free()` on line 504 indirectly during the call to `CRYPTO_lock()`.
Showing all 22 steps of the trace


crypto/bn/bn_mont.c:504:5: invalidation part of the trace starts here
502.       BN_MONT_CTX *ret;
503.   
504.       CRYPTO_r_lock(lock);
           ^
505.       ret = *pmont;
506.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:504:5: global variable `dyn_locks` accessed here
  502.       BN_MONT_CTX *ret;
  503.   
  504.       CRYPTO_r_lock(lock);
             ^
  505.       ret = *pmont;
  506.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:504:5: when calling `CRYPTO_lock` here
  502.       BN_MONT_CTX *ret;
  503.   
  504.       CRYPTO_r_lock(lock);
             ^
  505.       ret = *pmont;
  506.       CRYPTO_r_unlock(lock);

crypto/lock.c:444:19: global variable `dyn_locks` accessed here
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer
    444.                   = CRYPTO_get_dynlock_value(type);
                             ^
    445.   
    446.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:450:13: when calling `CRYPTO_destroy_dynlockid` here
    448.               dynlock_lock_callback(mode, pointer, file, line);
    449.   
    450.               CRYPTO_destroy_dynlockid(type);
                       ^
    451.           }
    452.       } else if (locking_callback != NULL)

crypto/lock.c:301:9: global variable `dyn_locks` accessed here
      299.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      300.   
      301.       if (dyn_locks == NULL || i >= sk_CRYPTO_dynlock_num(dyn_locks)) {
                     ^
      302.           CRYPTO_w_unlock(CRYPTO_LOCK_DYNLOCK);
      303.           return;

crypto/lock.c:305:15: passed as argument to `sk_CRYPTO_dynlock_value`
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:305:15: return from call to `sk_CRYPTO_dynlock_value`
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:305:5: assigned
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                 ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:323:9: when calling `CRYPTO_free` here
      321.       if (pointer) {
      322.           dynlock_destroy_callback(pointer->data, __FILE__, __LINE__);
      323.           OPENSSL_free(pointer);
                     ^
      324.       }
      325.   }

crypto/mem.c:225:1: parameter `str` of CRYPTO_free
        223.   }
        224.   
        225. > void CRYPTO_free(void *str, const char *file, int line)
        226.   {
        227.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:241:5: was invalidated by call to `free()`
        239.       }
        240.   #else
        241.       free(str);
                   ^
        242.   #endif
        243.   }

crypto/bn/bn_mont.c:504:5: use-after-lifetime part of the trace starts here
502.       BN_MONT_CTX *ret;
503.   
504.       CRYPTO_r_lock(lock);
           ^
505.       ret = *pmont;
506.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:504:5: global variable `dyn_locks` accessed here
  502.       BN_MONT_CTX *ret;
  503.   
  504.       CRYPTO_r_lock(lock);
             ^
  505.       ret = *pmont;
  506.       CRYPTO_r_unlock(lock);

crypto/bn/bn_mont.c:506:5: when calling `CRYPTO_lock` here
  504.       CRYPTO_r_lock(lock);
  505.       ret = *pmont;
  506.       CRYPTO_r_unlock(lock);
             ^
  507.       if (ret)
  508.           return ret;

crypto/lock.c:444:19: global variable `dyn_locks` accessed here
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer
    444.                   = CRYPTO_get_dynlock_value(type);
                             ^
    445.   
    446.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:450:13: when calling `CRYPTO_destroy_dynlockid` here
    448.               dynlock_lock_callback(mode, pointer, file, line);
    449.   
    450.               CRYPTO_destroy_dynlockid(type);
                       ^
    451.           }
    452.       } else if (locking_callback != NULL)

crypto/lock.c:301:9: global variable `dyn_locks` accessed here
      299.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      300.   
      301.       if (dyn_locks == NULL || i >= sk_CRYPTO_dynlock_num(dyn_locks)) {
                     ^
      302.           CRYPTO_w_unlock(CRYPTO_LOCK_DYNLOCK);
      303.           return;

crypto/lock.c:305:15: passed as argument to `sk_CRYPTO_dynlock_value`
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:305:15: return from call to `sk_CRYPTO_dynlock_value`
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:305:5: assigned
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                 ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:314:13: invalid access occurs here
      312.           } else
      313.   #endif
      314.           if (pointer->references <= 0) {
                         ^
      315.               (void)sk_CRYPTO_dynlock_set(dyn_locks, i, NULL);
      316.           } else
