crypto/hmac/hmac.c:199: error: USE_AFTER_FREE
  call to `EVP_MD_CTX_free()` eventually accesses memory that was invalidated by call to `free()` on line 198 indirectly during the call to `hmac_ctx_cleanup()`.
Showing all 16 steps of the trace


crypto/hmac/hmac.c:195:1: invalidation part of the trace starts here
193.   }
194.   
195. > void HMAC_CTX_free(HMAC_CTX *ctx)
196.   {
197.       if (ctx != NULL) {

crypto/hmac/hmac.c:195:1: parameter `ctx` of HMAC_CTX_free
  193.   }
  194.   
  195. > void HMAC_CTX_free(HMAC_CTX *ctx)
  196.   {
  197.       if (ctx != NULL) {

crypto/hmac/hmac.c:198:9: when calling `hmac_ctx_cleanup` here
  196.   {
  197.       if (ctx != NULL) {
  198.           hmac_ctx_cleanup(ctx);
                 ^
  199.           EVP_MD_CTX_free(ctx->i_ctx);
  200.           EVP_MD_CTX_free(ctx->o_ctx);

crypto/hmac/hmac.c:185:1: parameter `ctx` of hmac_ctx_cleanup
    183.   }
    184.   
    185. > static void hmac_ctx_cleanup(HMAC_CTX *ctx)
    186.   {
    187.       EVP_MD_CTX_reset(ctx->i_ctx);

crypto/hmac/hmac.c:187:5: when calling `EVP_MD_CTX_reset` here
    185.   static void hmac_ctx_cleanup(HMAC_CTX *ctx)
    186.   {
    187.       EVP_MD_CTX_reset(ctx->i_ctx);
               ^
    188.       EVP_MD_CTX_reset(ctx->o_ctx);
    189.       EVP_MD_CTX_reset(ctx->md_ctx);

crypto/evp/digest.c:122:1: parameter `ctx` of EVP_MD_CTX_reset
      120.   
      121.   /* This call frees resources associated with the context */
      122. > int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
      123.   {
      124.       if (ctx == NULL)

crypto/evp/digest.c:136:9: when calling `CRYPTO_clear_free` here
      134.       if (ctx->digest && ctx->digest->ctx_size && ctx->md_data
      135.           && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {
      136.           OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
                     ^
      137.       }
      138.       EVP_PKEY_CTX_free(ctx->pctx);

crypto/mem.c:248:1: parameter `str` of CRYPTO_clear_free
        246.   }
        247.   
        248. > void CRYPTO_clear_free(void *str, size_t num)
        249.   {
        250.       if (str == NULL)

crypto/mem.c:254:5: when calling `CRYPTO_free` here
        252.       if (num)
        253.           OPENSSL_cleanse(str, num);
        254.       CRYPTO_free(str);
                   ^
        255.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
          231.   }
          232.   
          233. > void CRYPTO_free(void *str)
          234.   {
          235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
          242.       }
          243.   #else
          244.       free(str);
                     ^
          245.   #endif
          246.   }

crypto/hmac/hmac.c:195:1: use-after-lifetime part of the trace starts here
193.   }
194.   
195. > void HMAC_CTX_free(HMAC_CTX *ctx)
196.   {
197.       if (ctx != NULL) {

crypto/hmac/hmac.c:195:1: parameter `ctx` of HMAC_CTX_free
  193.   }
  194.   
  195. > void HMAC_CTX_free(HMAC_CTX *ctx)
  196.   {
  197.       if (ctx != NULL) {

crypto/hmac/hmac.c:199:9: when calling `EVP_MD_CTX_free` here
  197.       if (ctx != NULL) {
  198.           hmac_ctx_cleanup(ctx);
  199.           EVP_MD_CTX_free(ctx->i_ctx);
                 ^
  200.           EVP_MD_CTX_free(ctx->o_ctx);
  201.           EVP_MD_CTX_free(ctx->md_ctx);

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }
