crypto/async/async.c:343: error: USE_AFTER_FREE
  call to `async_job_free()` eventually accesses memory that was invalidated by call to `free()` on line 343 indirectly during the call to `async_job_free()`.
Showing all 20 steps of the trace


crypto/async/async.c:334:1: invalidation part of the trace starts here
332.   }
333.   
334. > static void async_empty_pool(async_pool *pool)
335.   {
336.       ASYNC_JOB *job;

crypto/async/async.c:334:1: parameter `pool` of async_empty_pool
  332.   }
  333.   
  334. > static void async_empty_pool(async_pool *pool)
  335.   {
  336.       ASYNC_JOB *job;

crypto/async/async.c:342:15: passed as argument to `sk_ASYNC_JOB_pop`
  340.   
  341.       do {
  342.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  343.           async_job_free(job);
  344.       } while (job);

crypto/async/async.c:342:15: return from call to `sk_ASYNC_JOB_pop`
  340.   
  341.       do {
  342.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  343.           async_job_free(job);
  344.       } while (job);

crypto/async/async.c:342:9: assigned
  340.   
  341.       do {
  342.           job = sk_ASYNC_JOB_pop(pool->jobs);
                 ^
  343.           async_job_free(job);
  344.       } while (job);

crypto/async/async.c:343:9: when calling `async_job_free` here
  341.       do {
  342.           job = sk_ASYNC_JOB_pop(pool->jobs);
  343.           async_job_free(job);
                 ^
  344.       } while (job);
  345.   }

crypto/async/async.c:146:1: parameter `job` of async_job_free
    144.   }
    145.   
    146. > static void async_job_free(ASYNC_JOB *job)
    147.   {
    148.       if (job != NULL) {

crypto/async/async.c:153:9: when calling `CRYPTO_free` here
    151.           async_close_fd(job->wait_fd);
    152.           async_close_fd(job->wake_fd);
    153.           OPENSSL_free(job);
                   ^
    154.       }
    155.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }

crypto/async/async.c:334:1: use-after-lifetime part of the trace starts here
332.   }
333.   
334. > static void async_empty_pool(async_pool *pool)
335.   {
336.       ASYNC_JOB *job;

crypto/async/async.c:334:1: parameter `pool` of async_empty_pool
  332.   }
  333.   
  334. > static void async_empty_pool(async_pool *pool)
  335.   {
  336.       ASYNC_JOB *job;

crypto/async/async.c:342:15: passed as argument to `sk_ASYNC_JOB_pop`
  340.   
  341.       do {
  342.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  343.           async_job_free(job);
  344.       } while (job);

crypto/async/async.c:342:15: return from call to `sk_ASYNC_JOB_pop`
  340.   
  341.       do {
  342.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  343.           async_job_free(job);
  344.       } while (job);

crypto/async/async.c:342:9: assigned
  340.   
  341.       do {
  342.           job = sk_ASYNC_JOB_pop(pool->jobs);
                 ^
  343.           async_job_free(job);
  344.       } while (job);

crypto/async/async.c:343:9: when calling `async_job_free` here
  341.       do {
  342.           job = sk_ASYNC_JOB_pop(pool->jobs);
  343.           async_job_free(job);
                 ^
  344.       } while (job);
  345.   }

crypto/async/async.c:146:1: parameter `job` of async_job_free
    144.   }
    145.   
    146. > static void async_job_free(ASYNC_JOB *job)
    147.   {
    148.       if (job != NULL) {

crypto/async/async.c:153:9: when calling `CRYPTO_free` here
    151.           async_close_fd(job->wait_fd);
    152.           async_close_fd(job->wake_fd);
    153.           OPENSSL_free(job);
                   ^
    154.       }
    155.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }

void CRYPTO_free(void *str)
{
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0);
        free(str);
        CRYPTO_mem_debug_free(str, 1);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static void async_empty_pool(async_pool *pool)\n{\n    ASYNC_JOB *job;\n    if (!pool || !pool->jobs)\n        return;\n    do {\n        job = sk_ASYNC_JOB_pop(pool->jobs);\n        async_job_free(job);\n    } while (job);\n}', 'static void async_job_free(ASYNC_JOB *job)\n{\n    if (job != NULL) {\n        OPENSSL_free(job->funcargs);\n        async_fibre_free(&job->fibrectx);\n        async_close_fd(job->wait_fd);\n        async_close_fd(job->wake_fd);\n        OPENSSL_free(job);\n    }\n}', 'void CRYPTO_free(void *str)\n{\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']