ssl/t1_ext.c:248: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 244 indirectly during the call to `CRYPTO_realloc()`.
Showing all 12 steps of the trace


ssl/t1_ext.c:217:1: invalidation part of the trace starts here
215.   
216.   /* Set callbacks for a custom extension. */
217. > static int custom_ext_meth_add(custom_ext_methods *exts,
218.                                  unsigned int ext_type,
219.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:217:1: parameter `exts` of custom_ext_meth_add
  215.   
  216.   /* Set callbacks for a custom extension. */
  217. > static int custom_ext_meth_add(custom_ext_methods *exts,
  218.                                  unsigned int ext_type,
  219.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:244:11: when calling `CRYPTO_realloc` here
  242.       if (custom_ext_find(exts, ext_type))
  243.           return 0;
  244.       tmp = OPENSSL_realloc(exts->meths,
                   ^
  245.                             (exts->meths_count + 1) * sizeof(custom_ext_method));
  246.   

crypto/mem.c:107:1: parameter `str` of CRYPTO_realloc
    105.   }
    106.   
    107. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    108.   {
    109.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:116:9: when calling `CRYPTO_free` here
    114.   
    115.       if (num == 0) {
    116.           CRYPTO_free(str, file, line);
                   ^
    117.           return NULL;
    118.       }

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
      161.   }
      162.   
      163. > void CRYPTO_free(void *str, const char *file, int line)
      164.   {
      165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
      177.       }
      178.   #else
      179.       free(str);
                 ^
      180.   #endif
      181.   }

ssl/t1_ext.c:217:1: use-after-lifetime part of the trace starts here
215.   
216.   /* Set callbacks for a custom extension. */
217. > static int custom_ext_meth_add(custom_ext_methods *exts,
218.                                  unsigned int ext_type,
219.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:217:1: parameter `exts` of custom_ext_meth_add
  215.   
  216.   /* Set callbacks for a custom extension. */
  217. > static int custom_ext_meth_add(custom_ext_methods *exts,
  218.                                  unsigned int ext_type,
  219.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:248:9: when calling `CRYPTO_free` here
  246.   
  247.       if (tmp == NULL) {
  248.           OPENSSL_free(exts->meths);
                 ^
  249.           exts->meths = NULL;
  250.           exts->meths_count = 0;

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
    161.   }
    162.   
    163. > void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: invalid access occurs here
    177.       }
    178.   #else
    179.       free(str);
               ^
    180.   #endif
    181.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int custom_ext_meth_add(custom_ext_methods *exts,\n                               unsigned int ext_type,\n                               custom_ext_add_cb add_cb,\n                               custom_ext_free_cb free_cb,\n                               void *add_arg,\n                               custom_ext_parse_cb parse_cb, void *parse_arg)\n{\n    custom_ext_method *meth, *tmp;\n    if (!add_cb && free_cb)\n        return 0;\n    if (SSL_extension_supported(ext_type) &&\n        ext_type != TLSEXT_TYPE_signed_certificate_timestamp)\n        return 0;\n    if (ext_type > 0xffff)\n        return 0;\n    if (custom_ext_find(exts, ext_type))\n        return 0;\n    tmp = OPENSSL_realloc(exts->meths,\n                          (exts->meths_count + 1) * sizeof(custom_ext_method));\n    if (tmp == NULL) {\n        OPENSSL_free(exts->meths);\n        exts->meths = NULL;\n        exts->meths_count = 0;\n        return 0;\n    }\n    exts->meths = tmp;\n    meth = exts->meths + exts->meths_count;\n    memset(meth, 0, sizeof(*meth));\n    meth->parse_cb = parse_cb;\n    meth->add_cb = add_cb;\n    meth->free_cb = free_cb;\n    meth->ext_type = ext_type;\n    meth->add_arg = add_arg;\n    meth->parse_arg = parse_arg;\n    exts->meths_count++;\n    return 1;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    osslargused(file); osslargused(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']