crypto/x509/x509_lu.c:242: error: USE_AFTER_FREE
  call to `X509_LOOKUP_shutdown()` eventually accesses memory that was invalidated by call to `free()` on line 243 indirectly during the call to `X509_LOOKUP_free()`.
Showing all 18 steps of the trace


crypto/x509/x509_lu.c:229:1: invalidation part of the trace starts here
227.   	}
228.   
229. > void X509_STORE_free(X509_STORE *vfy)
230.   	{
231.   	int i;

crypto/x509/x509_lu.c:229:1: parameter `vfy` of X509_STORE_free
  227.   	}
  228.   
  229. > void X509_STORE_free(X509_STORE *vfy)
  230.   	{
  231.   	int i;

crypto/x509/x509_lu.c:238:2: assigned
  236.   	    return;
  237.   
  238.   	sk=vfy->get_cert_methods;
          ^
  239.   	for (i=0; i<sk_X509_LOOKUP_num(sk); i++)
  240.   		{

crypto/x509/x509_lu.c:241:6: passed as argument to `sk_X509_LOOKUP_value`
  239.   	for (i=0; i<sk_X509_LOOKUP_num(sk); i++)
  240.   		{
  241.   		lu=sk_X509_LOOKUP_value(sk,i);
              ^
  242.   		X509_LOOKUP_shutdown(lu);
  243.   		X509_LOOKUP_free(lu);

crypto/x509/x509_lu.c:241:6: return from call to `sk_X509_LOOKUP_value`
  239.   	for (i=0; i<sk_X509_LOOKUP_num(sk); i++)
  240.   		{
  241.   		lu=sk_X509_LOOKUP_value(sk,i);
              ^
  242.   		X509_LOOKUP_shutdown(lu);
  243.   		X509_LOOKUP_free(lu);

crypto/x509/x509_lu.c:241:3: assigned
  239.   	for (i=0; i<sk_X509_LOOKUP_num(sk); i++)
  240.   		{
  241.   		lu=sk_X509_LOOKUP_value(sk,i);
           ^
  242.   		X509_LOOKUP_shutdown(lu);
  243.   		X509_LOOKUP_free(lu);

crypto/x509/x509_lu.c:243:3: when calling `X509_LOOKUP_free` here
  241.   		lu=sk_X509_LOOKUP_value(sk,i);
  242.   		X509_LOOKUP_shutdown(lu);
  243.   		X509_LOOKUP_free(lu);
           ^
  244.   		}
  245.   	sk_X509_LOOKUP_free(sk);

crypto/x509/x509_lu.c:87:1: parameter `ctx` of X509_LOOKUP_free
    85.   	}
    86.   
    87. > void X509_LOOKUP_free(X509_LOOKUP *ctx)
    88.   	{
    89.   	if (ctx == NULL) return;

crypto/x509/x509_lu.c:93:2: was invalidated by call to `free()`
    91.   		(ctx->method->free != NULL))
    92.   		ctx->method->free(ctx);
    93.   	Free(ctx);
           ^
    94.   	}
    95.   

crypto/x509/x509_lu.c:229:1: use-after-lifetime part of the trace starts here
227.   	}
228.   
229. > void X509_STORE_free(X509_STORE *vfy)
230.   	{
231.   	int i;

crypto/x509/x509_lu.c:229:1: parameter `vfy` of X509_STORE_free
  227.   	}
  228.   
  229. > void X509_STORE_free(X509_STORE *vfy)
  230.   	{
  231.   	int i;

crypto/x509/x509_lu.c:238:2: assigned
  236.   	    return;
  237.   
  238.   	sk=vfy->get_cert_methods;
          ^
  239.   	for (i=0; i<sk_X509_LOOKUP_num(sk); i++)
  240.   		{

crypto/x509/x509_lu.c:241:6: passed as argument to `sk_X509_LOOKUP_value`
  239.   	for (i=0; i<sk_X509_LOOKUP_num(sk); i++)
  240.   		{
  241.   		lu=sk_X509_LOOKUP_value(sk,i);
              ^
  242.   		X509_LOOKUP_shutdown(lu);
  243.   		X509_LOOKUP_free(lu);

crypto/x509/x509_lu.c:241:6: return from call to `sk_X509_LOOKUP_value`
  239.   	for (i=0; i<sk_X509_LOOKUP_num(sk); i++)
  240.   		{
  241.   		lu=sk_X509_LOOKUP_value(sk,i);
              ^
  242.   		X509_LOOKUP_shutdown(lu);
  243.   		X509_LOOKUP_free(lu);

crypto/x509/x509_lu.c:241:3: assigned
  239.   	for (i=0; i<sk_X509_LOOKUP_num(sk); i++)
  240.   		{
  241.   		lu=sk_X509_LOOKUP_value(sk,i);
           ^
  242.   		X509_LOOKUP_shutdown(lu);
  243.   		X509_LOOKUP_free(lu);

crypto/x509/x509_lu.c:242:3: when calling `X509_LOOKUP_shutdown` here
  240.   		{
  241.   		lu=sk_X509_LOOKUP_value(sk,i);
  242.   		X509_LOOKUP_shutdown(lu);
           ^
  243.   		X509_LOOKUP_free(lu);
  244.   		}

crypto/x509/x509_lu.c:105:1: parameter `ctx` of X509_LOOKUP_shutdown
    103.   	}
    104.   
    105. > int X509_LOOKUP_shutdown(X509_LOOKUP *ctx)
    106.   	{
    107.   	if (ctx->method == NULL) return(0);

crypto/x509/x509_lu.c:108:6: invalid access occurs here
    106.   	{
    107.   	if (ctx->method == NULL) return(0);
    108.   	if (ctx->method->shutdown != NULL)
                ^
    109.   		return(ctx->method->shutdown(ctx));
    110.   	else

int X509_LOOKUP_shutdown(X509_LOOKUP *ctx)
	{
	if (ctx->method == NULL) return(0);
	if (ctx->method->shutdown != NULL)
		return(ctx->method->shutdown(ctx));
	else
		return(1);
	}
['void X509_STORE_free(X509_STORE *vfy)\n\t{\n\tint i;\n\tSTACK_OF(X509_LOOKUP) *sk;\n\tX509_LOOKUP *lu;\n\tif(vfy == NULL)\n\t    return;\n\tsk=vfy->get_cert_methods;\n\tfor (i=0; i<sk_X509_LOOKUP_num(sk); i++)\n\t\t{\n\t\tlu=sk_X509_LOOKUP_value(sk,i);\n\t\tX509_LOOKUP_shutdown(lu);\n\t\tX509_LOOKUP_free(lu);\n\t\t}\n\tsk_X509_LOOKUP_free(sk);\n\tCRYPTO_free_ex_data(x509_store_meth,(char *)vfy,&vfy->ex_data);\n\tlh_doall(vfy->certs,cleanup);\n\tlh_free(vfy->certs);\n\tFree(vfy);\n\t}', 'void X509_LOOKUP_free(X509_LOOKUP *ctx)\n\t{\n\tif (ctx == NULL) return;\n\tif (\t(ctx->method != NULL) &&\n\t\t(ctx->method->free != NULL))\n\t\tctx->method->free(ctx);\n\tFree(ctx);\n\t}', 'int X509_LOOKUP_shutdown(X509_LOOKUP *ctx)\n\t{\n\tif (ctx->method == NULL) return(0);\n\tif (ctx->method->shutdown != NULL)\n\t\treturn(ctx->method->shutdown(ctx));\n\telse\n\t\treturn(1);\n\t}']