If you use EVP_CIPHER_CTX_copy() on a an existing EVP_CIPHER_CTX that was initialised using a cipher from the dasync ENGINE, then subsequently freeing the source and destination EVP_CIPHER_CTX objects results in a double free.

The reason is that, by default, the copy operation simply does a memcpy on the internal cipher data:

Unfortunately, for the dasync engine, this internal cipher data contains pointers to other data which is managed internally to the daysnc engine. When the source and destination EVP_CIPHER_CTX objects subsequently get freed the internal pointers (which are identical) are also freed twice - and hence a double free occurs.

To avoid this problem, engines that need to are supposed to use the EVP_CIPH_CUSTOM_COPY flag, but the dasync engine does not do this.