apps/ts.c:537: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_free()` eventually accesses memory that was invalidated by call to `free()` on line 536 indirectly during the call to `EVP_DigestFinal()`.
Showing all 28 steps of the trace


apps/ts.c:525:30: invalidation part of the trace starts here
523.   
524.       if (input) {
525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                    ^
526.           unsigned char buffer[4096];
527.           int length;

apps/ts.c:525:30: passed as argument to `EVP_MD_CTX_new`
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:525:30: return from call to `EVP_MD_CTX_new`
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:525:9: assigned
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                 ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:536:14: when calling `EVP_DigestFinal` here
  534.               EVP_DigestUpdate(md_ctx, buffer, length);
  535.           }
  536.           if (!EVP_DigestFinal(md_ctx, *md_value, NULL)) {
                      ^
  537.               EVP_MD_CTX_free(md_ctx);
  538.               return 0;

crypto/evp/digest.c:260:1: parameter `ctx` of EVP_DigestFinal
    258.   
    259.   /* The caller can assume that this removes any secret data from the context */
    260. > int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
    261.   {
    262.       int ret;

crypto/evp/digest.c:264:5: when calling `EVP_MD_CTX_reset` here
    262.       int ret;
    263.       ret = EVP_DigestFinal_ex(ctx, md, size);
    264.       EVP_MD_CTX_reset(ctx);
               ^
    265.       return ret;
    266.   }

crypto/evp/digest.c:122:1: parameter `ctx` of EVP_MD_CTX_reset
      120.   
      121.   /* This call frees resources associated with the context */
      122. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
      123.   {
      124.       if (ctx == NULL)

crypto/evp/digest.c:138:5: when calling `EVP_PKEY_CTX_free` here
      136.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
      137.       }
      138.       EVP_PKEY_CTX_free(ctx->pctx);
                 ^
      139.   #ifndef OPENSSL_NO_ENGINE
      140.       if (ctx->engine)

crypto/evp/pmeth_lib.c:323:1: parameter `ctx` of EVP_PKEY_CTX_free
        321.   }
        322.   
        323. > void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)
        324.   {
        325.       if (ctx == NULL)

crypto/evp/pmeth_lib.c:330:5: when calling `EVP_PKEY_free` here
        328.           ctx->pmeth->cleanup(ctx);
        329.       EVP_PKEY_free(ctx->pkey);
        330.       EVP_PKEY_free(ctx->peerkey);
                   ^
        331.   #ifndef OPENSSL_NO_ENGINE
        332.       if (ctx->engine)

crypto/evp/p_lib.c:420:1: parameter `x` of EVP_PKEY_free
          418.   }
          419.   
          420. > void EVP_PKEY_free(EVP_PKEY *x)
          421.   {
          422.       int i;

crypto/evp/p_lib.c:433:5: when calling `sk_X509_ATTRIBUTE_pop_free` here
          431.       REF_ASSERT_ISNT(i < 0);
          432.       EVP_PKEY_free_it(x);
          433.       sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
                     ^
          434.       OPENSSL_free(x);
          435.   }

include/openssl/x509.h:159:1: parameter `sk` of sk_X509_ATTRIBUTE_pop_free
            157.   typedef struct x509_attributes_st X509_ATTRIBUTE;
            158.   
            159. > DEFINE_STACK_OF(X509_ATTRIBUTE)
            160.   
            161.   typedef struct X509_req_info_st X509_REQ_INFO;

include/openssl/x509.h:159:1: when calling `sk_pop_free` here
            157.   typedef struct x509_attributes_st X509_ATTRIBUTE;
            158.   
            159. > DEFINE_STACK_OF(X509_ATTRIBUTE)
            160.   
            161.   typedef struct X509_req_info_st X509_REQ_INFO;

crypto/stack/stack.c:296:1: parameter `st` of sk_pop_free
              294.   }
              295.   
              296. > void sk_pop_free(_STACK *st, void (*func) (void *))
              297.   {
              298.       int i;

crypto/stack/stack.c:305:5: when calling `sk_free` here
              303.           if (st->data[i] != NULL)
              304.               func(st->data[i]);
              305.       sk_free(st);
                         ^
              306.   }
              307.   

crypto/stack/stack.c:308:1: parameter `st` of sk_free
                306.   }
                307.   
                308. > void sk_free(_STACK *st)
                309.   {
                310.       if (st == NULL)

crypto/stack/stack.c:312:5: when calling `CRYPTO_free` here
                310.       if (st == NULL)
                311.           return;
                312.       OPENSSL_free(st->data);
                           ^
                313.       OPENSSL_free(st);
                314.   }

crypto/mem.c:225:1: parameter `str` of CRYPTO_free
                  223.   }
                  224.   
                  225. > void CRYPTO_free(void *str, const char *file, int line)
                  226.   {
                  227.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:241:5: was invalidated by call to `free()`
                  239.       }
                  240.   #else
                  241.       free(str);
                             ^
                  242.   #endif
                  243.   }

apps/ts.c:525:30: use-after-lifetime part of the trace starts here
523.   
524.       if (input) {
525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                    ^
526.           unsigned char buffer[4096];
527.           int length;

apps/ts.c:525:30: passed as argument to `EVP_MD_CTX_new`
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:525:30: return from call to `EVP_MD_CTX_new`
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:525:9: assigned
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                 ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:537:13: when calling `EVP_MD_CTX_free` here
  535.           }
  536.           if (!EVP_DigestFinal(md_ctx, *md_value, NULL)) {
  537.               EVP_MD_CTX_free(md_ctx);
                     ^
  538.               return 0;
  539.           }

crypto/mem.c:225:1: parameter `str` of CRYPTO_free
    223.   }
    224.   
    225. > void CRYPTO_free(void *str, const char *file, int line)
    226.   {
    227.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:241:5: invalid access occurs here
    239.       }
    240.   #else
    241.       free(str);
               ^
    242.   #endif
    243.   }
