crypto/hmac/hmac.c:115: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_copy_ex()` eventually accesses memory that was invalidated by call to `free()` on line 113 indirectly during the call to `EVP_DigestFinal_ex()`.
Showing all 16 steps of the trace


crypto/hmac/hmac.c:105:1: invalidation part of the trace starts here
103.   }
104.   
105. > int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len)
106.   {
107.       unsigned int i;

crypto/hmac/hmac.c:105:1: parameter `ctx` of HMAC_Final
  103.   }
  104.   
  105. > int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len)
  106.   {
  107.       unsigned int i;

crypto/hmac/hmac.c:113:10: when calling `EVP_DigestFinal_ex` here
  111.           goto err;
  112.   
  113.       if (!EVP_DigestFinal_ex(ctx->md_ctx, buf, &i))
                  ^
  114.           goto err;
  115.       if (!EVP_MD_CTX_copy_ex(ctx->md_ctx, ctx->o_ctx))

crypto/evp/digest.c:311:1: parameter `ctx` of EVP_DigestFinal_ex
    309.   
    310.   /* The caller can assume that this removes any secret data from the context */
    311. > int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *isize)
    312.   {
    313.       int ret;

crypto/evp/digest.c:336:5: when calling `EVP_MD_CTX_reset` here
    334.       }
    335.   
    336.       EVP_MD_CTX_reset(ctx);
               ^
    337.   
    338.       return ret;

crypto/evp/digest.c:20:1: parameter `ctx` of EVP_MD_CTX_reset
      18.   
      19.   /* This call frees resources associated with the context */
      20. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
      21.   {
      22.       if (ctx == NULL)

crypto/evp/digest.c:52:9: when calling `CRYPTO_clear_free` here
      50.       if (ctx->digest && ctx->digest->ctx_size && ctx->md_data
      51.           && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {
      52.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
                    ^
      53.       }
      54.       /*

crypto/mem.c:316:1: parameter `str` of CRYPTO_clear_free
        314.   }
        315.   
        316. > void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)
        317.   {
        318.       if (str == NULL)

crypto/mem.c:322:5: when calling `CRYPTO_free` here
        320.       if (num)
        321.           OPENSSL_cleanse(str, num);
        322.       CRYPTO_free(str, file, line);
                   ^
        323.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
          293.   }
          294.   
          295. > void CRYPTO_free(void *str, const char *file, int line)
          296.   {
          297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
          310.       }
          311.   #else
          312.       free(str);
                     ^
          313.   #endif
          314.   }

crypto/hmac/hmac.c:105:1: use-after-lifetime part of the trace starts here
103.   }
104.   
105. > int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len)
106.   {
107.       unsigned int i;

crypto/hmac/hmac.c:105:1: parameter `ctx` of HMAC_Final
  103.   }
  104.   
  105. > int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len)
  106.   {
  107.       unsigned int i;

crypto/hmac/hmac.c:115:10: when calling `EVP_MD_CTX_copy_ex` here
  113.       if (!EVP_DigestFinal_ex(ctx->md_ctx, buf, &i))
  114.           goto err;
  115.       if (!EVP_MD_CTX_copy_ex(ctx->md_ctx, ctx->o_ctx))
                  ^
  116.           goto err;
  117.       if (!EVP_DigestUpdate(ctx->md_ctx, buf, i))

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }
