ssl/t1_enc.c:397: error: USE_AFTER_FREE
  call to `EVP_CipherInit_ex()` eventually accesses memory that was invalidated by call to `free()` on line 248 indirectly during the call to `EVP_CIPHER_CTX_reset()`.
Showing all 16 steps of the trace


ssl/t1_enc.c:242:37: invalidation part of the trace starts here
240.           if (s->enc_read_ctx != NULL)
241.               reuse_dd = 1;
242.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                           ^
243.               goto err;
244.           else

ssl/t1_enc.c:242:37: passed as argument to `EVP_CIPHER_CTX_new`
  240.           if (s->enc_read_ctx != NULL)
  241.               reuse_dd = 1;
  242.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  243.               goto err;
  244.           else

ssl/t1_enc.c:242:37: return from call to `EVP_CIPHER_CTX_new`
  240.           if (s->enc_read_ctx != NULL)
  241.               reuse_dd = 1;
  242.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  243.               goto err;
  244.           else

ssl/t1_enc.c:242:19: assigned
  240.           if (s->enc_read_ctx != NULL)
  241.               reuse_dd = 1;
  242.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                           ^
  243.               goto err;
  244.           else

ssl/t1_enc.c:248:13: when calling `EVP_CIPHER_CTX_reset` here
  246.                * make sure it's intialized in case we exit later with an error
  247.                */
  248.               EVP_CIPHER_CTX_reset(s->enc_read_ctx);
                     ^
  249.           dd = s->enc_read_ctx;
  250.           mac_ctx = ssl_replace_hash(&s->read_hash, NULL);

crypto/evp/evp_enc.c:69:1: parameter `c` of EVP_CIPHER_CTX_reset
    67.   #include "evp_locl.h"
    68.   
    69. > int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
    70.   {
    71.       if (c == NULL)

crypto/evp/evp_enc.c:80:5: when calling `CRYPTO_free` here
    78.               OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);
    79.       }
    80.       OPENSSL_free(c->cipher_data);
              ^
    81.   #ifndef OPENSSL_NO_ENGINE
    82.       if (c->engine)

crypto/mem.c:225:1: parameter `str` of CRYPTO_free
      223.   }
      224.   
      225. > void CRYPTO_free(void *str, const char *file, int line)
      226.   {
      227.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:241:5: was invalidated by call to `free()`
      239.       }
      240.   #else
      241.       free(str);
                 ^
      242.   #endif
      243.   }

ssl/t1_enc.c:242:37: use-after-lifetime part of the trace starts here
240.           if (s->enc_read_ctx != NULL)
241.               reuse_dd = 1;
242.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                           ^
243.               goto err;
244.           else

ssl/t1_enc.c:242:37: passed as argument to `EVP_CIPHER_CTX_new`
  240.           if (s->enc_read_ctx != NULL)
  241.               reuse_dd = 1;
  242.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  243.               goto err;
  244.           else

ssl/t1_enc.c:242:37: return from call to `EVP_CIPHER_CTX_new`
  240.           if (s->enc_read_ctx != NULL)
  241.               reuse_dd = 1;
  242.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  243.               goto err;
  244.           else

ssl/t1_enc.c:242:19: assigned
  240.           if (s->enc_read_ctx != NULL)
  241.               reuse_dd = 1;
  242.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                           ^
  243.               goto err;
  244.           else

ssl/t1_enc.c:397:14: when calling `EVP_CipherInit_ex` here
  395.           }
  396.       } else {
  397.           if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) {
                      ^
  398.               SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
  399.               goto err2;

crypto/mem.c:225:1: parameter `str` of CRYPTO_free
    223.   }
    224.   
    225. > void CRYPTO_free(void *str, const char *file, int line)
    226.   {
    227.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:241:5: invalid access occurs here
    239.       }
    240.   #else
    241.       free(str);
               ^
    242.   #endif
    243.   }
