test/bntest.c:2197: error: USE_AFTER_FREE
  call to `clearstanza()` eventually accesses memory that was invalidated by call to `free()` on line 2197 indirectly during the call to `clearstanza()`.
Showing all 16 steps of the trace


test/bntest.c:2188:5: invalidation part of the trace starts here
2186.   
2187.       /* Read test file. */
2188.       memset(&s, 0, sizeof(s));
            ^
2189.       while (!feof(fp) && readstanza(&s, &linesread)) {
2190.           if (s.numpairs == 0)

test/bntest.c:2188:5: variable `s` accessed here
  2186.   
  2187.       /* Read test file. */
  2188.       memset(&s, 0, sizeof(s));
              ^
  2189.       while (!feof(fp) && readstanza(&s, &linesread)) {
  2190.           if (s.numpairs == 0)

test/bntest.c:2197:9: when calling `clearstanza` here
  2195.               goto err;
  2196.           }
  2197.           clearstanza(&s);
                  ^
  2198.           s.start = linesread;
  2199.       }

test/bntest.c:2142:1: parameter `s` of clearstanza
    2140.   }
    2141.   
    2142. > static void clearstanza(STANZA *s)
    2143.   {
    2144.       PAIR *pp = s->pairs;

test/bntest.c:2144:5: assigned
    2142.   static void clearstanza(STANZA *s)
    2143.   {
    2144.       PAIR *pp = s->pairs;
                ^
    2145.       int i = s->numpairs;
    2146.       int start = s->start;

test/bntest.c:2149:9: when calling `CRYPTO_free` here
    2147.   
    2148.       for ( ; --i >= 0; pp++) {
    2149.           OPENSSL_free(pp->key);
                    ^
    2150.           OPENSSL_free(pp->value);
    2151.       }

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
      251.   }
      252.   
      253. > void CRYPTO_free(void *str, const char *file, int line)
      254.   {
      255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: was invalidated by call to `free()`
      267.       }
      268.   #else
      269.       free(str);
                 ^
      270.   #endif
      271.   }

test/bntest.c:2188:5: use-after-lifetime part of the trace starts here
2186.   
2187.       /* Read test file. */
2188.       memset(&s, 0, sizeof(s));
            ^
2189.       while (!feof(fp) && readstanza(&s, &linesread)) {
2190.           if (s.numpairs == 0)

test/bntest.c:2188:5: variable `s` accessed here
  2186.   
  2187.       /* Read test file. */
  2188.       memset(&s, 0, sizeof(s));
              ^
  2189.       while (!feof(fp) && readstanza(&s, &linesread)) {
  2190.           if (s.numpairs == 0)

test/bntest.c:2197:9: when calling `clearstanza` here
  2195.               goto err;
  2196.           }
  2197.           clearstanza(&s);
                  ^
  2198.           s.start = linesread;
  2199.       }

test/bntest.c:2142:1: parameter `s` of clearstanza
    2140.   }
    2141.   
    2142. > static void clearstanza(STANZA *s)
    2143.   {
    2144.       PAIR *pp = s->pairs;

test/bntest.c:2144:5: assigned
    2142.   static void clearstanza(STANZA *s)
    2143.   {
    2144.       PAIR *pp = s->pairs;
                ^
    2145.       int i = s->numpairs;
    2146.       int start = s->start;

test/bntest.c:2149:9: when calling `CRYPTO_free` here
    2147.   
    2148.       for ( ; --i >= 0; pp++) {
    2149.           OPENSSL_free(pp->key);
                    ^
    2150.           OPENSSL_free(pp->value);
    2151.       }

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
      251.   }
      252.   
      253. > void CRYPTO_free(void *str, const char *file, int line)
      254.   {
      255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: invalid access occurs here
      267.       }
      268.   #else
      269.       free(str);
                 ^
      270.   #endif
      271.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int file_tests()\n{\n    STANZA s;\n    int linesread = 0, result = 0;\n    memset(&s, 0, sizeof(s));\n    while (!feof(fp) && readstanza(&s, &linesread)) {\n        if (s.numpairs == 0)\n            continue;\n        if (!file_test_run(&s)) {\n            if (result == 0)\n                fprintf(stderr, "Test at %d failed\\n", s.start);\n            goto err;\n        }\n        clearstanza(&s);\n        s.start = linesread;\n    }\n    result = 1;\nerr:\n    return result;\n}', 'static void clearstanza(STANZA *s)\n{\n    PAIR *pp = s->pairs;\n    int i = s->numpairs;\n    int start = s->start;\n    for ( ; --i >= 0; pp++) {\n        OPENSSL_free(pp->key);\n        OPENSSL_free(pp->value);\n    }\n    memset(s, 0, sizeof(*s));\n    s->start = start;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']