crypto/lhash/lhash.c:165: error: USE_AFTER_FREE
  call to `getrn()` eventually accesses memory that was invalidated by call to `free()` on line 163 indirectly during the call to `expand()`.
Showing all 14 steps of the trace


crypto/lhash/lhash.c:155:1: invalidation part of the trace starts here
153.   }
154.   
155. > void *lh_insert(_LHASH *lh, void *data)
156.   {
157.       unsigned long hash;

crypto/lhash/lhash.c:155:1: parameter `lh` of lh_insert
  153.   }
  154.   
  155. > void *lh_insert(_LHASH *lh, void *data)
  156.   {
  157.       unsigned long hash;

crypto/lhash/lhash.c:163:9: when calling `expand` here
  161.       lh->error = 0;
  162.       if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))
  163.           expand(lh);
                 ^
  164.   
  165.       rn = getrn(lh, data, &hash);

crypto/lhash/lhash.c:278:1: parameter `lh` of expand
    276.   }
    277.   
    278. > static void expand(_LHASH *lh)
    279.   {
    280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:305:13: when calling `CRYPTO_realloc` here
    303.       if ((lh->p) >= lh->pmax) {
    304.           j = (int)lh->num_alloc_nodes * 2;
    305.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
                       ^
    306.           if (n == NULL) {
    307.               /* fputs("realloc error in lhash",stderr); */

crypto/mem.c:165:1: parameter `str` of CRYPTO_realloc
      163.   }
      164.   
      165. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      166.   {
      167.       if (str == NULL)

crypto/mem.c:171:9: when calling `CRYPTO_free` here
      169.   
      170.       if (num == 0) {
      171.           CRYPTO_free(str);
                     ^
      172.           return NULL;
      173.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
        231.   }
        232.   
        233. > void CRYPTO_free(void *str)
        234.   {
        235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
        242.       }
        243.   #else
        244.       free(str);
                   ^
        245.   #endif
        246.   }

crypto/lhash/lhash.c:155:1: use-after-lifetime part of the trace starts here
153.   }
154.   
155. > void *lh_insert(_LHASH *lh, void *data)
156.   {
157.       unsigned long hash;

crypto/lhash/lhash.c:155:1: parameter `lh` of lh_insert
  153.   }
  154.   
  155. > void *lh_insert(_LHASH *lh, void *data)
  156.   {
  157.       unsigned long hash;

crypto/lhash/lhash.c:165:10: when calling `getrn` here
  163.           expand(lh);
  164.   
  165.       rn = getrn(lh, data, &hash);
                  ^
  166.   
  167.       if (*rn == NULL) {

crypto/lhash/lhash.c:357:1: parameter `lh` of getrn
    355.   }
    356.   
    357. > static LHASH_NODE **getrn(_LHASH *lh, const void *data, unsigned long *rhash)
    358.   {
    359.       LHASH_NODE **ret, *n1;

crypto/lhash/lhash.c:372:5: invalid access occurs here
    370.   
    371.       cf = lh->comp;
    372.       ret = &(lh->b[(int)nn]);
               ^
    373.       for (n1 = *ret; n1 != NULL; n1 = n1->next) {
    374.           lh->num_hash_comps++;

static LHASH_NODE **getrn(_LHASH *lh, const void *data, unsigned long *rhash)
{
    LHASH_NODE **ret, *n1;
    unsigned long hash, nn;
    LHASH_COMP_FN_TYPE cf;
    hash = (*(lh->hash)) (data);
    lh->num_hash_calls++;
    *rhash = hash;
    nn = hash % lh->pmax;
    if (nn < lh->p)
        nn = hash % lh->num_alloc_nodes;
    cf = lh->comp;
    ret = &(lh->b[(int)nn]);
    for (n1 = *ret; n1 != NULL; n1 = n1->next) {
        lh->num_hash_comps++;
        if (n1->hash != hash) {
            ret = &(n1->next);
            continue;
        }
        lh->num_comp_calls++;
        if (cf(n1->data, data) == 0)
            break;
        ret = &(n1->next);
    }
    return (ret);
}
['void *lh_insert(_LHASH *lh, void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))\n        expand(lh);\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        if ((nn = OPENSSL_malloc(sizeof(*nn))) == NULL) {\n            lh->error++;\n            return (NULL);\n        }\n        nn->data = data;\n        nn->next = NULL;\n        nn->hash = hash;\n        *rn = nn;\n        ret = NULL;\n        lh->num_insert++;\n        lh->num_items++;\n    } else {\n        ret = (*rn)->data;\n        (*rn)->data = data;\n        lh->num_replace++;\n    }\n    return (ret);\n}', 'static void expand(_LHASH *lh)\n{\n    LHASH_NODE **n, **n1, **n2, *np;\n    unsigned int p, i, j;\n    unsigned long hash, nni;\n    lh->num_nodes++;\n    lh->num_expands++;\n    p = (int)lh->p++;\n    n1 = &(lh->b[p]);\n    n2 = &(lh->b[p + (int)lh->pmax]);\n    *n2 = NULL;\n    nni = lh->num_alloc_nodes;\n    for (np = *n1; np != NULL;) {\n        hash = np->hash;\n        if ((hash % nni) != p) {\n            *n1 = (*n1)->next;\n            np->next = *n2;\n            *n2 = np;\n        } else\n            n1 = &((*n1)->next);\n        np = *n1;\n    }\n    if ((lh->p) >= lh->pmax) {\n        j = (int)lh->num_alloc_nodes * 2;\n        n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));\n        if (n == NULL) {\n            lh->error++;\n            lh->p = 0;\n            return;\n        }\n        for (i = (int)lh->num_alloc_nodes; i < j; i++)\n            n[i] = NULL;\n        lh->pmax = lh->num_alloc_nodes;\n        lh->num_alloc_nodes = j;\n        lh->num_expand_reallocs++;\n        lh->p = 0;\n        lh->b = n;\n    }\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)file;\n    (void)line;\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str)\n{\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}', 'static LHASH_NODE **getrn(_LHASH *lh, const void *data, unsigned long *rhash)\n{\n    LHASH_NODE **ret, *n1;\n    unsigned long hash, nn;\n    LHASH_COMP_FN_TYPE cf;\n    hash = (*(lh->hash)) (data);\n    lh->num_hash_calls++;\n    *rhash = hash;\n    nn = hash % lh->pmax;\n    if (nn < lh->p)\n        nn = hash % lh->num_alloc_nodes;\n    cf = lh->comp;\n    ret = &(lh->b[(int)nn]);\n    for (n1 = *ret; n1 != NULL; n1 = n1->next) {\n        lh->num_hash_comps++;\n        if (n1->hash != hash) {\n            ret = &(n1->next);\n            continue;\n        }\n        lh->num_comp_calls++;\n        if (cf(n1->data, data) == 0)\n            break;\n        ret = &(n1->next);\n    }\n    return (ret);\n}']