apps/ts.c:537: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_free()` eventually accesses memory that was invalidated by call to `free()` on line 536 indirectly during the call to `EVP_DigestFinal()`.
Showing all 20 steps of the trace


apps/ts.c:525:30: invalidation part of the trace starts here
523.   
524.       if (input) {
525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                    ^
526.           unsigned char buffer[4096];
527.           int length;

apps/ts.c:525:30: passed as argument to `EVP_MD_CTX_new`
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:525:30: return from call to `EVP_MD_CTX_new`
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:525:9: assigned
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                 ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:536:14: when calling `EVP_DigestFinal` here
  534.               EVP_DigestUpdate(md_ctx, buffer, length);
  535.           }
  536.           if (!EVP_DigestFinal(md_ctx, *md_value, NULL)) {
                      ^
  537.               EVP_MD_CTX_free(md_ctx);
  538.               return 0;

crypto/evp/digest.c:255:1: parameter `ctx` of EVP_DigestFinal
    253.   
    254.   /* The caller can assume that this removes any secret data from the context */
    255. > int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
    256.   {
    257.       int ret;

crypto/evp/digest.c:259:5: when calling `EVP_MD_CTX_reset` here
    257.       int ret;
    258.       ret = EVP_DigestFinal_ex(ctx, md, size);
    259.       EVP_MD_CTX_reset(ctx);
               ^
    260.       return ret;
    261.   }

crypto/evp/digest.c:122:1: parameter `ctx` of EVP_MD_CTX_reset
      120.   
      121.   /* This call frees resources associated with the context */
      122. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
      123.   {
      124.       if (ctx == NULL)

crypto/evp/digest.c:138:5: when calling `EVP_PKEY_CTX_free` here
      136.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
      137.       }
      138.       EVP_PKEY_CTX_free(ctx->pctx);
                 ^
      139.   #ifndef OPENSSL_NO_ENGINE
      140.       ENGINE_finish(ctx->engine);

crypto/evp/pmeth_lib.c:322:1: parameter `ctx` of EVP_PKEY_CTX_free
        320.   }
        321.   
        322. > void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)
        323.   {
        324.       if (ctx == NULL)

crypto/evp/pmeth_lib.c:333:5: when calling `CRYPTO_free` here
        331.       ENGINE_finish(ctx->engine);
        332.   #endif
        333.       OPENSSL_free(ctx);
                   ^
        334.   }
        335.   

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
          208.   }
          209.   
          210. > void CRYPTO_free(void *str, const char *file, int line)
          211.   {
          212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: was invalidated by call to `free()`
          224.       }
          225.   #else
          226.       free(str);
                     ^
          227.   #endif
          228.   }

apps/ts.c:525:30: use-after-lifetime part of the trace starts here
523.   
524.       if (input) {
525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                    ^
526.           unsigned char buffer[4096];
527.           int length;

apps/ts.c:525:30: passed as argument to `EVP_MD_CTX_new`
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:525:30: return from call to `EVP_MD_CTX_new`
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                                      ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:525:9: assigned
  523.   
  524.       if (input) {
  525.           EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
                 ^
  526.           unsigned char buffer[4096];
  527.           int length;

apps/ts.c:537:13: when calling `EVP_MD_CTX_free` here
  535.           }
  536.           if (!EVP_DigestFinal(md_ctx, *md_value, NULL)) {
  537.               EVP_MD_CTX_free(md_ctx);
                     ^
  538.               return 0;
  539.           }

crypto/evp/pmeth_lib.c:322:1: parameter `ctx` of EVP_PKEY_CTX_free
    320.   }
    321.   
    322. > void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)
    323.   {
    324.       if (ctx == NULL)

crypto/evp/pmeth_lib.c:331:19: invalid access occurs here
    329.       EVP_PKEY_free(ctx->peerkey);
    330.   #ifndef OPENSSL_NO_ENGINE
    331.       ENGINE_finish(ctx->engine);
                             ^
    332.   #endif
    333.       OPENSSL_free(ctx);
