apps/engine.c:69: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 67 indirectly during the call to `CRYPTO_realloc()`.
Showing all 13 steps of the trace


apps/engine.c:50:1: invalidation part of the trace starts here
48.   };
49.   
50. > static int append_buf(char **buf, int *size, const char *s)
51.   {
52.       const int expand = 256;

apps/engine.c:50:1: parameter `buf` of append_buf
  48.   };
  49.   
  50. > static int append_buf(char **buf, int *size, const char *s)
  51.   {
  52.       const int expand = 256;

apps/engine.c:54:5: assigned
  52.       const int expand = 256;
  53.       int len = strlen(s) + 1;
  54.       char *p = *buf;
            ^
  55.   
  56.       if (p == NULL) {

apps/engine.c:67:17: when calling `CRYPTO_realloc` here
  65.           if (len > *size) {
  66.               *size = ((len + expand - 1) / expand) * expand;
  67.               p = OPENSSL_realloc(p, *size);
                        ^
  68.               if (p == NULL) {
  69.                   OPENSSL_free(*buf);

crypto/mem.c:231:1: parameter `str` of CRYPTO_realloc
    229.   }
    230.   
    231. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    232.   {
    233.       INCREMENT(realloc_count);

crypto/mem.c:242:9: when calling `CRYPTO_free` here
    240.   
    241.       if (num == 0) {
    242.           CRYPTO_free(str, file, line);
                   ^
    243.           return NULL;
    244.       }

crypto/mem.c:289:1: parameter `str` of CRYPTO_free
      287.   }
      288.   
      289. > void CRYPTO_free(void *str, const char *file, int line)
      290.   {
      291.       INCREMENT(free_count);

crypto/mem.c:306:5: was invalidated by call to `free()`
      304.       }
      305.   #else
      306.       free(str);
                 ^
      307.   #endif
      308.   }

apps/engine.c:50:1: use-after-lifetime part of the trace starts here
48.   };
49.   
50. > static int append_buf(char **buf, int *size, const char *s)
51.   {
52.       const int expand = 256;

apps/engine.c:50:1: parameter `buf` of append_buf
  48.   };
  49.   
  50. > static int append_buf(char **buf, int *size, const char *s)
  51.   {
  52.       const int expand = 256;

apps/engine.c:69:17: when calling `CRYPTO_free` here
  67.               p = OPENSSL_realloc(p, *size);
  68.               if (p == NULL) {
  69.                   OPENSSL_free(*buf);
                        ^
  70.                   *buf = NULL;
  71.                   return 0;

crypto/mem.c:289:1: parameter `str` of CRYPTO_free
    287.   }
    288.   
    289. > void CRYPTO_free(void *str, const char *file, int line)
    290.   {
    291.       INCREMENT(free_count);

crypto/mem.c:306:5: invalid access occurs here
    304.       }
    305.   #else
    306.       free(str);
               ^
    307.   #endif
    308.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int append_buf(char **buf, int *size, const char *s)\n{\n    const int expand = 256;\n    int len = strlen(s) + 1;\n    char *p = *buf;\n    if (p == NULL) {\n        *size = ((len + expand - 1) / expand) * expand;\n        p = *buf = app_malloc(*size, "engine buffer");\n    } else {\n        const int blen = strlen(p);\n        if (blen > 0)\n            len += 2 + blen;\n        if (len > *size) {\n            *size = ((len + expand - 1) / expand) * expand;\n            p = OPENSSL_realloc(p, *size);\n            if (p == NULL) {\n                OPENSSL_free(*buf);\n                *buf = NULL;\n                return 0;\n            }\n            *buf = p;\n        }\n        if (blen > 0) {\n            p += blen;\n            *p++ = \',\';\n            *p++ = \' \';\n        }\n    }\n    strcpy(p, s);\n    return 1;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    INCREMENT(realloc_count);\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']