ssl/s3_enc.c:327: error: USE_AFTER_FREE
  call to `EVP_CipherInit_ex()` eventually accesses memory that was invalidated by call to `free()` on line 236 indirectly during the call to `EVP_CIPHER_CTX_reset()`.
Showing all 16 steps of the trace


ssl/s3_enc.c:230:37: invalidation part of the trace starts here
228.           if (s->enc_read_ctx != NULL)
229.               reuse_dd = 1;
230.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                           ^
231.               goto err;
232.           else

ssl/s3_enc.c:230:37: passed as argument to `EVP_CIPHER_CTX_new`
  228.           if (s->enc_read_ctx != NULL)
  229.               reuse_dd = 1;
  230.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  231.               goto err;
  232.           else

ssl/s3_enc.c:230:37: return from call to `EVP_CIPHER_CTX_new`
  228.           if (s->enc_read_ctx != NULL)
  229.               reuse_dd = 1;
  230.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  231.               goto err;
  232.           else

ssl/s3_enc.c:230:19: assigned
  228.           if (s->enc_read_ctx != NULL)
  229.               reuse_dd = 1;
  230.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                           ^
  231.               goto err;
  232.           else

ssl/s3_enc.c:236:13: when calling `EVP_CIPHER_CTX_reset` here
  234.                * make sure it's intialized in case we exit later with an error
  235.                */
  236.               EVP_CIPHER_CTX_reset(s->enc_read_ctx);
                     ^
  237.           dd = s->enc_read_ctx;
  238.   

crypto/evp/evp_enc.c:69:1: parameter `c` of EVP_CIPHER_CTX_reset
    67.   #include "evp_locl.h"
    68.   
    69. > int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
    70.   {
    71.       if (c == NULL)

crypto/evp/evp_enc.c:80:5: when calling `CRYPTO_free` here
    78.               OPENSSL_cleanse(c->cipher_data, c->cipher->ctx_size);
    79.       }
    80.       OPENSSL_free(c->cipher_data);
              ^
    81.   #ifndef OPENSSL_NO_ENGINE
    82.       ENGINE_finish(c->engine);

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
      208.   }
      209.   
      210. > void CRYPTO_free(void *str, const char *file, int line)
      211.   {
      212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: was invalidated by call to `free()`
      224.       }
      225.   #else
      226.       free(str);
                 ^
      227.   #endif
      228.   }

ssl/s3_enc.c:230:37: use-after-lifetime part of the trace starts here
228.           if (s->enc_read_ctx != NULL)
229.               reuse_dd = 1;
230.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                           ^
231.               goto err;
232.           else

ssl/s3_enc.c:230:37: passed as argument to `EVP_CIPHER_CTX_new`
  228.           if (s->enc_read_ctx != NULL)
  229.               reuse_dd = 1;
  230.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  231.               goto err;
  232.           else

ssl/s3_enc.c:230:37: return from call to `EVP_CIPHER_CTX_new`
  228.           if (s->enc_read_ctx != NULL)
  229.               reuse_dd = 1;
  230.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                                             ^
  231.               goto err;
  232.           else

ssl/s3_enc.c:230:19: assigned
  228.           if (s->enc_read_ctx != NULL)
  229.               reuse_dd = 1;
  230.           else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
                           ^
  231.               goto err;
  232.           else

ssl/s3_enc.c:327:5: when calling `EVP_CipherInit_ex` here
  325.       memcpy(mac_secret, ms, i);
  326.   
  327.       EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE));
             ^
  328.   
  329.   #ifdef OPENSSL_SSL_TRACE_CRYPTO

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
    208.   }
    209.   
    210. > void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: invalid access occurs here
    224.       }
    225.   #else
    226.       free(str);
               ^
    227.   #endif
    228.   }
