apps/x509.c:1231: error: USE_AFTER_FREE
  call to `sk_X509_EXTENSION_free()` eventually accesses memory that was invalidated by call to `free()` on line 1217 indirectly during the call to `sk_X509_EXTENSION_push()`.
Showing all 24 steps of the trace


apps/x509.c:1215:33: invalidation part of the trace starts here
1213.                   /* push the extension into a new stack */
1214.                   if (exts2 == NULL
1215.                       && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
                                        ^
1216.                       goto end;
1217.                   if (!sk_X509_EXTENSION_push(exts2, ext))

apps/x509.c:1215:33: passed as argument to `sk_X509_EXTENSION_new_null`
  1213.                   /* push the extension into a new stack */
  1214.                   if (exts2 == NULL
  1215.                       && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
                                          ^
  1216.                       goto end;
  1217.                   if (!sk_X509_EXTENSION_push(exts2, ext))

apps/x509.c:1215:33: return from call to `sk_X509_EXTENSION_new_null`
  1213.                   /* push the extension into a new stack */
  1214.                   if (exts2 == NULL
  1215.                       && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
                                          ^
  1216.                       goto end;
  1217.                   if (!sk_X509_EXTENSION_push(exts2, ext))

apps/x509.c:1215:25: assigned
  1213.                   /* push the extension into a new stack */
  1214.                   if (exts2 == NULL
  1215.                       && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
                                  ^
  1216.                       goto end;
  1217.                   if (!sk_X509_EXTENSION_push(exts2, ext))

apps/x509.c:1217:22: when calling `sk_X509_EXTENSION_push` here
  1215.                       && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
  1216.                       goto end;
  1217.                   if (!sk_X509_EXTENSION_push(exts2, ext))
                               ^
  1218.                       goto end;
  1219.               }

include/openssl/x509.h:85:1: parameter `sk` of sk_X509_EXTENSION_push
    83.   typedef STACK_OF(X509_EXTENSION) X509_EXTENSIONS;
    84.   
    85. > DEFINE_STACK_OF(X509_EXTENSION)
    86.   
    87.   typedef struct x509_attributes_st X509_ATTRIBUTE;

include/openssl/x509.h:85:1: when calling `OPENSSL_sk_push` here
    83.   typedef STACK_OF(X509_EXTENSION) X509_EXTENSIONS;
    84.   
    85. > DEFINE_STACK_OF(X509_EXTENSION)
    86.   
    87.   typedef struct x509_attributes_st X509_ATTRIBUTE;

crypto/stack/stack.c:325:1: parameter `st` of OPENSSL_sk_push
      323.   }
      324.   
      325. > int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)
      326.   {
      327.       if (st == NULL)

crypto/stack/stack.c:329:12: when calling `OPENSSL_sk_insert` here
      327.       if (st == NULL)
      328.           return -1;
      329.       return OPENSSL_sk_insert(st, data, st->num);
                        ^
      330.   }
      331.   

crypto/stack/stack.c:236:1: parameter `st` of OPENSSL_sk_insert
        234.   }
        235.   
        236. > int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)
        237.   {
        238.       if (st == NULL || st->num == max_nodes)

crypto/stack/stack.c:241:10: when calling `sk_reserve` here
        239.           return 0;
        240.   
        241.       if (!sk_reserve(st, 1, 0))
                        ^
        242.           return 0;
        243.   

crypto/stack/stack.c:159:1: parameter `st` of sk_reserve
          157.   
          158.   /* internal STACK storage allocation */
          159. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
          160.   {
          161.       const void **tmpdata;

crypto/stack/stack.c:197:15: when calling `CRYPTO_realloc` here
          195.       }
          196.   
          197.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                               ^
          198.       if (tmpdata == NULL)
          199.           return 0;

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
            236.   }
            237.   
            238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            239.   {
            240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
            247.   
            248.       if (num == 0) {
            249.           CRYPTO_free(str, file, line);
                           ^
            250.           return NULL;
            251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
              293.   }
              294.   
              295. > void CRYPTO_free(void *str, const char *file, int line)
              296.   {
              297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
              310.       }
              311.   #else
              312.       free(str);
                         ^
              313.   #endif
              314.   }

apps/x509.c:1215:33: use-after-lifetime part of the trace starts here
1213.                   /* push the extension into a new stack */
1214.                   if (exts2 == NULL
1215.                       && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
                                        ^
1216.                       goto end;
1217.                   if (!sk_X509_EXTENSION_push(exts2, ext))

apps/x509.c:1215:33: passed as argument to `sk_X509_EXTENSION_new_null`
  1213.                   /* push the extension into a new stack */
  1214.                   if (exts2 == NULL
  1215.                       && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
                                          ^
  1216.                       goto end;
  1217.                   if (!sk_X509_EXTENSION_push(exts2, ext))

apps/x509.c:1215:33: return from call to `sk_X509_EXTENSION_new_null`
  1213.                   /* push the extension into a new stack */
  1214.                   if (exts2 == NULL
  1215.                       && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
                                          ^
  1216.                       goto end;
  1217.                   if (!sk_X509_EXTENSION_push(exts2, ext))

apps/x509.c:1215:25: assigned
  1213.                   /* push the extension into a new stack */
  1214.                   if (exts2 == NULL
  1215.                       && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
                                  ^
  1216.                       goto end;
  1217.                   if (!sk_X509_EXTENSION_push(exts2, ext))

apps/x509.c:1231:5: when calling `sk_X509_EXTENSION_free` here
  1229.       ret = X509V3_extensions_print(bio, NULL, exts2, 0, 0);
  1230.    end:
  1231.       sk_X509_EXTENSION_free(exts2);
              ^
  1232.       OPENSSL_free(names);
  1233.       OPENSSL_free(tmp_ext_names);

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int print_x509v3_exts(BIO *bio, X509 *x, const char *ext_names)\n{\n    const STACK_OF(X509_EXTENSION) *exts = NULL;\n    STACK_OF(X509_EXTENSION) *exts2 = NULL;\n    X509_EXTENSION *ext = NULL;\n    ASN1_OBJECT *obj;\n    int i, j, ret = 0, num, nn = 0;\n    const char *sn, **names = NULL;\n    char *tmp_ext_names = NULL;\n    exts = X509_get0_extensions(x);\n    if ((num = sk_X509_EXTENSION_num(exts)) <= 0) {\n        BIO_printf(bio, "No extensions in certificate\\n");\n        ret = 1;\n        goto end;\n    }\n    if ((tmp_ext_names = OPENSSL_strdup(ext_names)) == NULL)\n        goto end;\n    if ((nn = parse_ext_names(tmp_ext_names, NULL)) == 0) {\n        BIO_printf(bio, "Invalid extension names: %s\\n", ext_names);\n        goto end;\n    }\n    if ((names = OPENSSL_malloc(sizeof(char *) * nn)) == NULL)\n        goto end;\n    parse_ext_names(tmp_ext_names, names);\n    for (i = 0; i < num; i++) {\n        ext = sk_X509_EXTENSION_value(exts, i);\n        obj = X509_EXTENSION_get_object(ext);\n        sn = OBJ_nid2sn(OBJ_obj2nid(obj));\n        if (sn == NULL || strcmp(sn, "UNDEF") == 0)\n            continue;\n        for (j = 0; j < nn; j++) {\n            if (strcmp(sn, names[j]) == 0) {\n                if (exts2 == NULL\n                    && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)\n                    goto end;\n                if (!sk_X509_EXTENSION_push(exts2, ext))\n                    goto end;\n            }\n        }\n    }\n    if (!sk_X509_EXTENSION_num(exts2)) {\n        BIO_printf(bio, "No extensions matched with %s\\n", ext_names);\n        ret = 1;\n        goto end;\n    }\n    ret = X509V3_extensions_print(bio, NULL, exts2, 0, 0);\n end:\n    sk_X509_EXTENSION_free(exts2);\n    OPENSSL_free(names);\n    OPENSSL_free(tmp_ext_names);\n    return ret;\n}', 'int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)\n{\n    if (st == NULL)\n        return -1;\n    return OPENSSL_sk_insert(st, data, st->num);\n}', 'int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)\n{\n    if (st == NULL || st->num == max_nodes)\n        return 0;\n    if (!sk_reserve(st, 1, 0))\n        return 0;\n    if ((loc >= st->num) || (loc < 0)) {\n        st->data[st->num] = data;\n    } else {\n        memmove(&st->data[loc + 1], &st->data[loc],\n                sizeof(st->data[0]) * (st->num - loc));\n        st->data[loc] = data;\n    }\n    st->num++;\n    st->sorted = 0;\n    return st->num;\n}', 'static int sk_reserve(OPENSSL_STACK *st, int n, int exact)\n{\n    const void **tmpdata;\n    int num_alloc;\n    if (n > max_nodes - st->num)\n        return 0;\n    num_alloc = st->num + n;\n    if (num_alloc < min_nodes)\n        num_alloc = min_nodes;\n    if (st->data == NULL) {\n        if ((st->data = OPENSSL_zalloc(sizeof(void *) * num_alloc)) == NULL) {\n            CRYPTOerr(CRYPTO_F_SK_RESERVE, ERR_R_MALLOC_FAILURE);\n            return 0;\n        }\n        st->num_alloc = num_alloc;\n        return 1;\n    }\n    if (!exact) {\n        if (num_alloc <= st->num_alloc)\n            return 1;\n        num_alloc = compute_growth(num_alloc, st->num_alloc);\n        if (num_alloc == 0)\n            return 0;\n    } else if (num_alloc == st->num_alloc) {\n        return 1;\n    }\n    tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);\n    if (tmpdata == NULL)\n        return 0;\n    st->data = tmpdata;\n    st->num_alloc = num_alloc;\n    return 1;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    INCREMENT(realloc_count);\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']