crypto/ts/ts_rsp_sign.c:258: error: USE_AFTER_FREE
  call to `ASN1_INTEGER_free()` eventually accesses memory that was invalidated by call to `free()` on line 249 indirectly during the call to `ASN1_INTEGER_set()`.
Showing all 39 steps of the trace


crypto/ts/ts_rsp_sign.c:248:28: invalidation part of the trace starts here
246.           goto err;
247.       if (millis
248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
                                  ^
249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
250.           goto err;

crypto/ts/ts_rsp_sign.c:248:28: passed as argument to `ASN1_INTEGER_new`
  246.           goto err;
  247.       if (millis
  248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
                                    ^
  249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
  250.           goto err;

crypto/ts/ts_rsp_sign.c:248:28: return from call to `ASN1_INTEGER_new`
  246.           goto err;
  247.       if (millis
  248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
                                    ^
  249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
  250.           goto err;

crypto/ts/ts_rsp_sign.c:248:14: assigned
  246.           goto err;
  247.       if (millis
  248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
                      ^
  249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
  250.           goto err;

crypto/ts/ts_rsp_sign.c:249:17: when calling `ASN1_INTEGER_set` here
  247.       if (millis
  248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
  249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
                         ^
  250.           goto err;
  251.       if (micros

crypto/asn1/a_int.c:533:1: parameter `a` of ASN1_INTEGER_set
    531.   }
    532.   
    533. > int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);

crypto/asn1/a_int.c:535:12: when calling `ASN1_INTEGER_set_int64` here
    533.   int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);
                      ^
    536.   }
    537.   

crypto/asn1/a_int.c:518:1: parameter `a` of ASN1_INTEGER_set_int64
      516.   }
      517.   
      518. > int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);

crypto/asn1/a_int.c:520:12: when calling `asn1_string_set_int64` here
      518.   int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);
                        ^
      521.   }
      522.   

crypto/asn1/a_int.c:332:1: parameter `a` of asn1_string_set_int64
        330.   }
        331.   
        332. > static int asn1_string_set_int64(ASN1_STRING *a, int64_t r, int itype)
        333.   {
        334.       unsigned char tbuf[sizeof(r)];

crypto/asn1/a_int.c:350:12: when calling `ASN1_STRING_set` here
        348.           a->type &= ~V_ASN1_NEG;
        349.       }
        350.       return ASN1_STRING_set(a, tbuf + off, sizeof(tbuf) - off);
                          ^
        351.   }
        352.   

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
          269.   }
          270.   
          271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
          272.   {
          273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
          281.       }
          282.       if ((str->length <= len) || (str->data == NULL)) {
          283.           c = str->data;
                         ^
          284.           str->data = OPENSSL_realloc(c, len + 1);
          285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:284:21: when calling `CRYPTO_realloc` here
          282.       if ((str->length <= len) || (str->data == NULL)) {
          283.           c = str->data;
          284.           str->data = OPENSSL_realloc(c, len + 1);
                                     ^
          285.           if (str->data == NULL) {
          286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
            236.   }
            237.   
            238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            239.   {
            240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
            247.   
            248.       if (num == 0) {
            249.           CRYPTO_free(str, file, line);
                           ^
            250.           return NULL;
            251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
              293.   }
              294.   
              295. > void CRYPTO_free(void *str, const char *file, int line)
              296.   {
              297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
              310.       }
              311.   #else
              312.       free(str);
                         ^
              313.   #endif
              314.   }

crypto/ts/ts_rsp_sign.c:248:28: use-after-lifetime part of the trace starts here
246.           goto err;
247.       if (millis
248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
                                  ^
249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
250.           goto err;

crypto/ts/ts_rsp_sign.c:248:28: passed as argument to `ASN1_INTEGER_new`
  246.           goto err;
  247.       if (millis
  248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
                                    ^
  249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
  250.           goto err;

crypto/ts/ts_rsp_sign.c:248:28: return from call to `ASN1_INTEGER_new`
  246.           goto err;
  247.       if (millis
  248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
                                    ^
  249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
  250.           goto err;

crypto/ts/ts_rsp_sign.c:248:14: assigned
  246.           goto err;
  247.       if (millis
  248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
                      ^
  249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
  250.           goto err;

crypto/ts/ts_rsp_sign.c:249:17: passed as argument to `ASN1_INTEGER_set`
  247.       if (millis
  248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
  249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
                         ^
  250.           goto err;
  251.       if (micros

crypto/asn1/a_int.c:533:1: parameter `a` of ASN1_INTEGER_set
    531.   }
    532.   
    533. > int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);

crypto/asn1/a_int.c:535:12: passed as argument to `ASN1_INTEGER_set_int64`
    533.   int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);
                      ^
    536.   }
    537.   

crypto/asn1/a_int.c:518:1: parameter `a` of ASN1_INTEGER_set_int64
      516.   }
      517.   
      518. > int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);

crypto/asn1/a_int.c:520:12: passed as argument to `asn1_string_set_int64`
      518.   int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);
                        ^
      521.   }
      522.   

crypto/asn1/a_int.c:332:1: parameter `a` of asn1_string_set_int64
        330.   }
        331.   
        332. > static int asn1_string_set_int64(ASN1_STRING *a, int64_t r, int itype)
        333.   {
        334.       unsigned char tbuf[sizeof(r)];

crypto/asn1/a_int.c:350:12: passed as argument to `ASN1_STRING_set`
        348.           a->type &= ~V_ASN1_NEG;
        349.       }
        350.       return ASN1_STRING_set(a, tbuf + off, sizeof(tbuf) - off);
                          ^
        351.   }
        352.   

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
          269.   }
          270.   
          271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
          272.   {
          273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
          281.       }
          282.       if ((str->length <= len) || (str->data == NULL)) {
          283.           c = str->data;
                         ^
          284.           str->data = OPENSSL_realloc(c, len + 1);
          285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:287:13: assigned
          285.           if (str->data == NULL) {
          286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
          287.               str->data = c;
                             ^
          288.               return 0;
          289.           }

crypto/asn1/a_int.c:350:12: return from call to `ASN1_STRING_set`
        348.           a->type &= ~V_ASN1_NEG;
        349.       }
        350.       return ASN1_STRING_set(a, tbuf + off, sizeof(tbuf) - off);
                          ^
        351.   }
        352.   

crypto/asn1/a_int.c:520:12: return from call to `asn1_string_set_int64`
      518.   int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);
                        ^
      521.   }
      522.   

crypto/asn1/a_int.c:535:12: return from call to `ASN1_INTEGER_set_int64`
    533.   int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);
                      ^
    536.   }
    537.   

crypto/ts/ts_rsp_sign.c:249:17: return from call to `ASN1_INTEGER_set`
  247.       if (millis
  248.           && ((ctx->millis = ASN1_INTEGER_new()) == NULL
  249.               || !ASN1_INTEGER_set(ctx->millis, millis)))
                         ^
  250.           goto err;
  251.       if (micros

crypto/ts/ts_rsp_sign.c:258:5: when calling `ASN1_INTEGER_free` here
  256.       return 1;
  257.    err:
  258.       TS_RESP_CTX_accuracy_free(ctx);
             ^
  259.       TSerr(TS_F_TS_RESP_CTX_SET_ACCURACY, ERR_R_MALLOC_FAILURE);
  260.       return 0;

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,\n                             int secs, int millis, int micros)\n{\n    TS_RESP_CTX_accuracy_free(ctx);\n    if (secs\n        && ((ctx->seconds = ASN1_INTEGER_new()) == NULL\n            || !ASN1_INTEGER_set(ctx->seconds, secs)))\n        goto err;\n    if (millis\n        && ((ctx->millis = ASN1_INTEGER_new()) == NULL\n            || !ASN1_INTEGER_set(ctx->millis, millis)))\n        goto err;\n    if (micros\n        && ((ctx->micros = ASN1_INTEGER_new()) == NULL\n            || !ASN1_INTEGER_set(ctx->micros, micros)))\n        goto err;\n    return 1;\n err:\n    TS_RESP_CTX_accuracy_free(ctx);\n    TSerr(TS_F_TS_RESP_CTX_SET_ACCURACY, ERR_R_MALLOC_FAILURE);\n    return 0;\n}', 'int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)\n{\n    return ASN1_INTEGER_set_int64(a, v);\n}', 'int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)\n{\n    return asn1_string_set_int64(a, r, V_ASN1_INTEGER);\n}', 'static int asn1_string_set_int64(ASN1_STRING *a, int64_t r, int itype)\n{\n    unsigned char tbuf[sizeof(r)];\n    size_t off;\n    a->type = itype;\n    if (r < 0) {\n        off = asn1_put_uint64(tbuf, 0 - (uint64_t)r);\n        a->type |= V_ASN1_NEG;\n    } else {\n        off = asn1_put_uint64(tbuf, r);\n        a->type &= ~V_ASN1_NEG;\n    }\n    return ASN1_STRING_set(a, tbuf + off, sizeof(tbuf) - off);\n}', "int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)\n{\n    unsigned char *c;\n    const char *data = _data;\n    if (len < 0) {\n        if (data == NULL)\n            return 0;\n        else\n            len = strlen(data);\n    }\n    if ((str->length <= len) || (str->data == NULL)) {\n        c = str->data;\n        str->data = OPENSSL_realloc(c, len + 1);\n        if (str->data == NULL) {\n            ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);\n            str->data = c;\n            return 0;\n        }\n    }\n    str->length = len;\n    if (data != NULL) {\n        memcpy(str->data, data, len);\n        str->data[len] = '\\0';\n    }\n    return 1;\n}", 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    INCREMENT(realloc_count);\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']