crypto/ct/ct_oct.c:338: error: USE_AFTER_FREE
  call to `SCT_free()` eventually accesses memory that was invalidated by call to `free()` on line 338 indirectly during the call to `SCT_free()`.
Showing all 22 steps of the trace


crypto/ct/ct_oct.c:311:1: invalidation part of the trace starts here
309.   }
310.   
311. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
312.                               size_t len)
313.   {

crypto/ct/ct_oct.c:311:1: parameter `a` of o2i_SCT_LIST
  309.   }
  310.   
  311. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
  312.                               size_t len)
  313.   {

crypto/ct/ct_oct.c:336:9: assigned
  334.   
  335.           /* Use the given stack, but empty it first. */
  336.           sk = *a;
                 ^
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
  338.               SCT_free(sct);

crypto/ct/ct_oct.c:337:23: passed as argument to `sk_SCT_pop`
  335.           /* Use the given stack, but empty it first. */
  336.           sk = *a;
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  338.               SCT_free(sct);
  339.       }

crypto/ct/ct_oct.c:337:23: return from call to `sk_SCT_pop`
  335.           /* Use the given stack, but empty it first. */
  336.           sk = *a;
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  338.               SCT_free(sct);
  339.       }

crypto/ct/ct_oct.c:337:17: assigned
  335.           /* Use the given stack, but empty it first. */
  336.           sk = *a;
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
                         ^
  338.               SCT_free(sct);
  339.       }

crypto/ct/ct_oct.c:338:13: when calling `SCT_free` here
  336.           sk = *a;
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
  338.               SCT_free(sct);
                     ^
  339.       }
  340.   

crypto/ct/ct_sct.c:85:1: parameter `sct` of SCT_free
    83.   }
    84.   
    85. > void SCT_free(SCT *sct)
    86.   {
    87.       if (sct == NULL)

crypto/ct/ct_sct.c:91:5: when calling `CRYPTO_free` here
    89.   
    90.       OPENSSL_free(sct->log_id);
    91.       OPENSSL_free(sct->ext);
              ^
    92.       OPENSSL_free(sct->sig);
    93.       OPENSSL_free(sct->sct);

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
      208.   }
      209.   
      210. > void CRYPTO_free(void *str, const char *file, int line)
      211.   {
      212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: was invalidated by call to `free()`
      224.       }
      225.   #else
      226.       free(str);
                 ^
      227.   #endif
      228.   }

crypto/ct/ct_oct.c:311:1: use-after-lifetime part of the trace starts here
309.   }
310.   
311. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
312.                               size_t len)
313.   {

crypto/ct/ct_oct.c:311:1: parameter `a` of o2i_SCT_LIST
  309.   }
  310.   
  311. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
  312.                               size_t len)
  313.   {

crypto/ct/ct_oct.c:336:9: assigned
  334.   
  335.           /* Use the given stack, but empty it first. */
  336.           sk = *a;
                 ^
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
  338.               SCT_free(sct);

crypto/ct/ct_oct.c:337:23: passed as argument to `sk_SCT_pop`
  335.           /* Use the given stack, but empty it first. */
  336.           sk = *a;
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  338.               SCT_free(sct);
  339.       }

crypto/ct/ct_oct.c:337:23: return from call to `sk_SCT_pop`
  335.           /* Use the given stack, but empty it first. */
  336.           sk = *a;
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  338.               SCT_free(sct);
  339.       }

crypto/ct/ct_oct.c:337:17: assigned
  335.           /* Use the given stack, but empty it first. */
  336.           sk = *a;
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
                         ^
  338.               SCT_free(sct);
  339.       }

crypto/ct/ct_oct.c:338:13: when calling `SCT_free` here
  336.           sk = *a;
  337.           while ((sct = sk_SCT_pop(sk)) != NULL)
  338.               SCT_free(sct);
                     ^
  339.       }
  340.   

crypto/ct/ct_sct.c:85:1: parameter `sct` of SCT_free
    83.   }
    84.   
    85. > void SCT_free(SCT *sct)
    86.   {
    87.       if (sct == NULL)

crypto/ct/ct_sct.c:91:5: when calling `CRYPTO_free` here
    89.   
    90.       OPENSSL_free(sct->log_id);
    91.       OPENSSL_free(sct->ext);
              ^
    92.       OPENSSL_free(sct->sig);
    93.       OPENSSL_free(sct->sct);

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
      208.   }
      209.   
      210. > void CRYPTO_free(void *str, const char *file, int line)
      211.   {
      212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: invalid access occurs here
      224.       }
      225.   #else
      226.       free(str);
                 ^
      227.   #endif
      228.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,\n                            size_t len)\n{\n    STACK_OF(SCT) *sk = NULL;\n    size_t list_len, sct_len;\n    if (len < 2 || len > MAX_SCT_LIST_SIZE) {\n        CTerr(CT_F_O2I_SCT_LIST, CT_R_SCT_LIST_INVALID);\n        return NULL;\n    }\n    n2s(*pp, list_len);\n    if (list_len != len - 2) {\n        CTerr(CT_F_O2I_SCT_LIST, CT_R_SCT_LIST_INVALID);\n        return NULL;\n    }\n    if (a == NULL || *a == NULL) {\n        sk = sk_SCT_new_null();\n        if (sk == NULL)\n            return NULL;\n    } else {\n        SCT *sct;\n        sk = *a;\n        while ((sct = sk_SCT_pop(sk)) != NULL)\n            SCT_free(sct);\n    }\n    while (list_len > 0) {\n        SCT *sct;\n        if (list_len < 2) {\n            CTerr(CT_F_O2I_SCT_LIST, CT_R_SCT_LIST_INVALID);\n            goto err;\n        }\n        n2s(*pp, sct_len);\n        list_len -= 2;\n        if (sct_len == 0 || sct_len > list_len) {\n            CTerr(CT_F_O2I_SCT_LIST, CT_R_SCT_LIST_INVALID);\n            goto err;\n        }\n        list_len -= sct_len;\n        if ((sct = o2i_SCT(NULL, pp, sct_len)) == NULL)\n            goto err;\n        if (!sk_SCT_push(sk, sct)) {\n            SCT_free(sct);\n            goto err;\n        }\n    }\n    if (a != NULL && *a == NULL)\n        *a = sk;\n    return sk;\n err:\n    if (a == NULL || *a == NULL)\n        SCT_LIST_free(sk);\n    return NULL;\n}', 'void SCT_free(SCT *sct)\n{\n    if (sct == NULL)\n        return;\n    OPENSSL_free(sct->log_id);\n    OPENSSL_free(sct->ext);\n    OPENSSL_free(sct->sig);\n    OPENSSL_free(sct->sct);\n    OPENSSL_free(sct);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']