crypto/async/async.c:295: error: USE_AFTER_FREE
  call to `async_job_free()` eventually accesses memory that was invalidated by call to `free()` on line 295 indirectly during the call to `async_job_free()`.
Showing all 40 steps of the trace


crypto/async/async.c:286:1: invalidation part of the trace starts here
284.   }
285.   
286. > static void async_empty_pool(async_pool *pool)
287.   {
288.       ASYNC_JOB *job;

crypto/async/async.c:286:1: parameter `pool` of async_empty_pool
  284.   }
  285.   
  286. > static void async_empty_pool(async_pool *pool)
  287.   {
  288.       ASYNC_JOB *job;

crypto/async/async.c:294:15: passed as argument to `sk_ASYNC_JOB_pop`
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async_locl.h:67:1: parameter `sk` of sk_ASYNC_JOB_pop
    65.   };
    66.   
    67. > DEFINE_STACK_OF(ASYNC_JOB)
    68.   
    69.   struct async_pool_st {

crypto/async/async_locl.h:67:1: passed as argument to `OPENSSL_sk_pop`
    65.   };
    66.   
    67. > DEFINE_STACK_OF(ASYNC_JOB)
    68.   
    69.   struct async_pool_st {

crypto/stack/stack.c:344:1: parameter `st` of OPENSSL_sk_pop
      342.   }
      343.   
      344. > void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      345.   {
      346.       if (st == NULL || st->num == 0)

crypto/stack/stack.c:348:12: passed as argument to `internal_delete`
      346.       if (st == NULL || st->num == 0)
      347.           return NULL;
      348.       return internal_delete(st, st->num - 1);
                        ^
      349.   }
      350.   

crypto/stack/stack.c:261:10: passed as argument to function `memmove` with no summary
        259.   
        260.       if (loc != st->num - 1)
        261.            memmove(&st->data[loc], &st->data[loc + 1],
                        ^
        262.                    sizeof(st->data[0]) * (st->num - loc - 1));
        263.       st->num--;

crypto/stack/stack.c:261:10: return from call to function `memmove` with no summary
        259.   
        260.       if (loc != st->num - 1)
        261.            memmove(&st->data[loc], &st->data[loc + 1],
                        ^
        262.                    sizeof(st->data[0]) * (st->num - loc - 1));
        263.       st->num--;

crypto/stack/stack.c:348:12: return from call to `internal_delete`
      346.       if (st == NULL || st->num == 0)
      347.           return NULL;
      348.       return internal_delete(st, st->num - 1);
                        ^
      349.   }
      350.   

crypto/async/async_locl.h:67:1: return from call to `OPENSSL_sk_pop`
    65.   };
    66.   
    67. > DEFINE_STACK_OF(ASYNC_JOB)
    68.   
    69.   struct async_pool_st {

crypto/async/async.c:294:15: return from call to `sk_ASYNC_JOB_pop`
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async.c:294:15: passed as argument to `sk_ASYNC_JOB_pop`
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async.c:294:15: return from call to `sk_ASYNC_JOB_pop`
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async.c:294:9: assigned
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                 ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async.c:295:9: when calling `async_job_free` here
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
  295.           async_job_free(job);
                 ^
  296.       } while (job);
  297.   }

crypto/async/async.c:95:1: parameter `job` of async_job_free
    93.   }
    94.   
    95. > static void async_job_free(ASYNC_JOB *job)
    96.   {
    97.       if (job != NULL) {

crypto/async/async.c:100:9: when calling `CRYPTO_free` here
    98.           OPENSSL_free(job->funcargs);
    99.           async_fibre_free(&job->fibrectx);
    100.           OPENSSL_free(job);
                   ^
    101.       }
    102.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
      310.       }
      311.   #else
      312.       free(str);
                 ^
      313.   #endif
      314.   }

crypto/async/async.c:286:1: use-after-lifetime part of the trace starts here
284.   }
285.   
286. > static void async_empty_pool(async_pool *pool)
287.   {
288.       ASYNC_JOB *job;

crypto/async/async.c:286:1: parameter `pool` of async_empty_pool
  284.   }
  285.   
  286. > static void async_empty_pool(async_pool *pool)
  287.   {
  288.       ASYNC_JOB *job;

crypto/async/async.c:294:15: passed as argument to `sk_ASYNC_JOB_pop`
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async_locl.h:67:1: parameter `sk` of sk_ASYNC_JOB_pop
    65.   };
    66.   
    67. > DEFINE_STACK_OF(ASYNC_JOB)
    68.   
    69.   struct async_pool_st {

crypto/async/async_locl.h:67:1: passed as argument to `OPENSSL_sk_pop`
    65.   };
    66.   
    67. > DEFINE_STACK_OF(ASYNC_JOB)
    68.   
    69.   struct async_pool_st {

crypto/stack/stack.c:344:1: parameter `st` of OPENSSL_sk_pop
      342.   }
      343.   
      344. > void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      345.   {
      346.       if (st == NULL || st->num == 0)

crypto/stack/stack.c:348:12: passed as argument to `internal_delete`
      346.       if (st == NULL || st->num == 0)
      347.           return NULL;
      348.       return internal_delete(st, st->num - 1);
                        ^
      349.   }
      350.   

crypto/stack/stack.c:261:10: passed as argument to function `memmove` with no summary
        259.   
        260.       if (loc != st->num - 1)
        261.            memmove(&st->data[loc], &st->data[loc + 1],
                        ^
        262.                    sizeof(st->data[0]) * (st->num - loc - 1));
        263.       st->num--;

crypto/stack/stack.c:261:10: return from call to function `memmove` with no summary
        259.   
        260.       if (loc != st->num - 1)
        261.            memmove(&st->data[loc], &st->data[loc + 1],
                        ^
        262.                    sizeof(st->data[0]) * (st->num - loc - 1));
        263.       st->num--;

crypto/stack/stack.c:348:12: return from call to `internal_delete`
      346.       if (st == NULL || st->num == 0)
      347.           return NULL;
      348.       return internal_delete(st, st->num - 1);
                        ^
      349.   }
      350.   

crypto/async/async_locl.h:67:1: return from call to `OPENSSL_sk_pop`
    65.   };
    66.   
    67. > DEFINE_STACK_OF(ASYNC_JOB)
    68.   
    69.   struct async_pool_st {

crypto/async/async.c:294:15: return from call to `sk_ASYNC_JOB_pop`
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async.c:294:15: passed as argument to `sk_ASYNC_JOB_pop`
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async.c:294:15: return from call to `sk_ASYNC_JOB_pop`
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async.c:294:9: assigned
  292.   
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
                 ^
  295.           async_job_free(job);
  296.       } while (job);

crypto/async/async.c:295:9: when calling `async_job_free` here
  293.       do {
  294.           job = sk_ASYNC_JOB_pop(pool->jobs);
  295.           async_job_free(job);
                 ^
  296.       } while (job);
  297.   }

crypto/async/async.c:95:1: parameter `job` of async_job_free
    93.   }
    94.   
    95. > static void async_job_free(ASYNC_JOB *job)
    96.   {
    97.       if (job != NULL) {

crypto/async/async.c:100:9: when calling `CRYPTO_free` here
    98.           OPENSSL_free(job->funcargs);
    99.           async_fibre_free(&job->fibrectx);
    100.           OPENSSL_free(job);
                   ^
    101.       }
    102.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
      310.       }
      311.   #else
      312.       free(str);
                 ^
      313.   #endif
      314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static void async_empty_pool(async_pool *pool)\n{\n    ASYNC_JOB *job;\n    if (!pool || !pool->jobs)\n        return;\n    do {\n        job = sk_ASYNC_JOB_pop(pool->jobs);\n        async_job_free(job);\n    } while (job);\n}', 'DEFINE_STACK_OF(ASYNC_JOB)', 'void *OPENSSL_sk_pop(OPENSSL_STACK *st)\n{\n    if (st == NULL || st->num == 0)\n        return NULL;\n    return internal_delete(st, st->num - 1);\n}', 'static ossl_inline void *internal_delete(OPENSSL_STACK *st, int loc)\n{\n    const void *ret = st->data[loc];\n    if (loc != st->num - 1)\n         memmove(&st->data[loc], &st->data[loc + 1],\n                 sizeof(st->data[0]) * (st->num - loc - 1));\n    st->num--;\n    return (void *)ret;\n}', 'static void async_job_free(ASYNC_JOB *job)\n{\n    if (job != NULL) {\n        OPENSSL_free(job->funcargs);\n        async_fibre_free(&job->fibrectx);\n        OPENSSL_free(job);\n    }\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']