crypto/ocsp/ocsp_ext.c:454: error: USE_AFTER_FREE
  call to `OBJ_txt2nid()` eventually accesses memory that was invalidated by call to `free()` on line 454 indirectly during the call to `OBJ_txt2nid()`.
Showing all 17 steps of the trace


crypto/ocsp/ocsp_ext.c:454:20: invalidation part of the trace starts here
452.           goto err;
453.       while (oids && *oids) {
454.           if ((nid = OBJ_txt2nid(*oids)) != NID_undef && (o = OBJ_nid2obj(nid)))
                          ^
455.               sk_ASN1_OBJECT_push(sk, o);
456.           oids++;

crypto/ocsp/ocsp_ext.c:454:20: global variable `added` accessed here
  452.           goto err;
  453.       while (oids && *oids) {
  454.           if ((nid = OBJ_txt2nid(*oids)) != NID_undef && (o = OBJ_nid2obj(nid)))
                            ^
  455.               sk_ASN1_OBJECT_push(sk, o);
  456.           oids++;

crypto/ocsp/ocsp_ext.c:454:20: when calling `OBJ_txt2nid` here
  452.           goto err;
  453.       while (oids && *oids) {
  454.           if ((nid = OBJ_txt2nid(*oids)) != NID_undef && (o = OBJ_nid2obj(nid)))
                            ^
  455.               sk_ASN1_OBJECT_push(sk, o);
  456.           oids++;

crypto/objects/obj_dat.c:594:11: global variable `added` accessed here
    592.       ASN1_OBJECT *obj;
    593.       int nid;
    594.       obj = OBJ_txt2obj(s, 0);
                     ^
    595.       nid = OBJ_obj2nid(obj);
    596.       ASN1_OBJECT_free(obj);

crypto/objects/obj_dat.c:594:11: passed as argument to `OBJ_txt2obj`
    592.       ASN1_OBJECT *obj;
    593.       int nid;
    594.       obj = OBJ_txt2obj(s, 0);
                     ^
    595.       nid = OBJ_obj2nid(obj);
    596.       ASN1_OBJECT_free(obj);

crypto/objects/obj_dat.c:594:11: return from call to `OBJ_txt2obj`
    592.       ASN1_OBJECT *obj;
    593.       int nid;
    594.       obj = OBJ_txt2obj(s, 0);
                     ^
    595.       nid = OBJ_obj2nid(obj);
    596.       ASN1_OBJECT_free(obj);

crypto/objects/obj_dat.c:594:5: assigned
    592.       ASN1_OBJECT *obj;
    593.       int nid;
    594.       obj = OBJ_txt2obj(s, 0);
               ^
    595.       nid = OBJ_obj2nid(obj);
    596.       ASN1_OBJECT_free(obj);

crypto/objects/obj_dat.c:596:5: when calling `ASN1_OBJECT_free` here
    594.       obj = OBJ_txt2obj(s, 0);
    595.       nid = OBJ_obj2nid(obj);
    596.       ASN1_OBJECT_free(obj);
               ^
    597.       return nid;
    598.   }

crypto/asn1/a_object.c:379:1: parameter `a` of ASN1_OBJECT_free
      377.   }
      378.   
      379. > void ASN1_OBJECT_free(ASN1_OBJECT *a)
      380.   {
      381.       if (a == NULL)

crypto/asn1/a_object.c:398:9: when calling `CRYPTO_free` here
      396.       }
      397.       if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC)
      398.           OPENSSL_free(a);
                     ^
      399.   }
      400.   

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
        231.   }
        232.   
        233. > void CRYPTO_free(void *str)
        234.   {
        235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
        242.       }
        243.   #else
        244.       free(str);
                   ^
        245.   #endif
        246.   }

crypto/ocsp/ocsp_ext.c:454:20: use-after-lifetime part of the trace starts here
452.           goto err;
453.       while (oids && *oids) {
454.           if ((nid = OBJ_txt2nid(*oids)) != NID_undef && (o = OBJ_nid2obj(nid)))
                          ^
455.               sk_ASN1_OBJECT_push(sk, o);
456.           oids++;

crypto/ocsp/ocsp_ext.c:454:20: global variable `added` accessed here
  452.           goto err;
  453.       while (oids && *oids) {
  454.           if ((nid = OBJ_txt2nid(*oids)) != NID_undef && (o = OBJ_nid2obj(nid)))
                            ^
  455.               sk_ASN1_OBJECT_push(sk, o);
  456.           oids++;

crypto/ocsp/ocsp_ext.c:454:20: when calling `OBJ_txt2nid` here
  452.           goto err;
  453.       while (oids && *oids) {
  454.           if ((nid = OBJ_txt2nid(*oids)) != NID_undef && (o = OBJ_nid2obj(nid)))
                            ^
  455.               sk_ASN1_OBJECT_push(sk, o);
  456.           oids++;

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }

void CRYPTO_free(void *str)
{
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0);
        free(str);
        CRYPTO_mem_debug_free(str, 1);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['X509_EXTENSION *OCSP_accept_responses_new(char **oids)\n{\n    int nid;\n    STACK_OF(ASN1_OBJECT) *sk = NULL;\n    ASN1_OBJECT *o = NULL;\n    X509_EXTENSION *x = NULL;\n    if ((sk = sk_ASN1_OBJECT_new_null()) == NULL)\n        goto err;\n    while (oids && *oids) {\n        if ((nid = OBJ_txt2nid(*oids)) != NID_undef && (o = OBJ_nid2obj(nid)))\n            sk_ASN1_OBJECT_push(sk, o);\n        oids++;\n    }\n    x = X509V3_EXT_i2d(NID_id_pkix_OCSP_acceptableResponses, 0, sk);\n err:\n    sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free);\n    return x;\n}', 'int OBJ_txt2nid(const char *s)\n{\n    ASN1_OBJECT *obj;\n    int nid;\n    obj = OBJ_txt2obj(s, 0);\n    nid = OBJ_obj2nid(obj);\n    ASN1_OBJECT_free(obj);\n    return nid;\n}', 'void ASN1_OBJECT_free(ASN1_OBJECT *a)\n{\n    if (a == NULL)\n        return;\n    if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS) {\n#ifndef CONST_STRICT\n        OPENSSL_free((void*)a->sn);\n        OPENSSL_free((void*)a->ln);\n#endif\n        a->sn = a->ln = NULL;\n    }\n    if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_DATA) {\n        OPENSSL_free((void*)a->data);\n        a->data = NULL;\n        a->length = 0;\n    }\n    if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC)\n        OPENSSL_free(a);\n}', 'void CRYPTO_free(void *str)\n{\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']