test/bntest.c:2118: error: USE_AFTER_FREE
  call to `clearstanza()` eventually accesses memory that was invalidated by call to `free()` on line 2118 indirectly during the call to `clearstanza()`.
Showing all 22 steps of the trace


test/bntest.c:2111:5: invalidation part of the trace starts here
2109.       /* Read test file. */
2110.       set_test_title(testfiles[i]);
2111.       memset(&s, 0, sizeof(s));
            ^
2112.       while (!BIO_eof(fp) && readstanza(&s)) {
2113.           if (s.numpairs == 0)

test/bntest.c:2111:5: variable `s` accessed here
  2109.       /* Read test file. */
  2110.       set_test_title(testfiles[i]);
  2111.       memset(&s, 0, sizeof(s));
              ^
  2112.       while (!BIO_eof(fp) && readstanza(&s)) {
  2113.           if (s.numpairs == 0)

test/bntest.c:2115:14: passed as argument to `file_test_run`
  2113.           if (s.numpairs == 0)
  2114.               continue;
  2115.           if (!file_test_run(&s)) {
                       ^
  2116.               errcnt++;
  2117.           }

test/bntest.c:2068:1: parameter `s` of file_test_run
    2066.   }
    2067.   
    2068. > static int file_test_run(STANZA *s)
    2069.   {
    2070.       static const FILETEST filetests[] = {

test/bntest.c:2115:14: return from call to `file_test_run`
  2113.           if (s.numpairs == 0)
  2114.               continue;
  2115.           if (!file_test_run(&s)) {
                       ^
  2116.               errcnt++;
  2117.           }

test/bntest.c:2118:9: when calling `clearstanza` here
  2116.               errcnt++;
  2117.           }
  2118.           clearstanza(&s);
                  ^
  2119.       }
  2120.       BIO_free(fp);

test/bntest.c:2052:1: parameter `s` of clearstanza
    2050.   }
    2051.   
    2052. > static void clearstanza(STANZA *s)
    2053.   {
    2054.       PAIR *pp = s->pairs;

test/bntest.c:2054:5: assigned
    2052.   static void clearstanza(STANZA *s)
    2053.   {
    2054.       PAIR *pp = s->pairs;
                ^
    2055.       int i = s->numpairs;
    2056.       int start = s->start;

test/bntest.c:2061:9: when calling `CRYPTO_free` here
    2059.       for ( ; --i >= 0; pp++) {
    2060.           OPENSSL_free(pp->key);
    2061.           OPENSSL_free(pp->value);
                    ^
    2062.       }
    2063.       memset(s, 0, sizeof(*s));

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
      251.   }
      252.   
      253. > void CRYPTO_free(void *str, const char *file, int line)
      254.   {
      255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: was invalidated by call to `free()`
      267.       }
      268.   #else
      269.       free(str);
                 ^
      270.   #endif
      271.   }

test/bntest.c:2111:5: use-after-lifetime part of the trace starts here
2109.       /* Read test file. */
2110.       set_test_title(testfiles[i]);
2111.       memset(&s, 0, sizeof(s));
            ^
2112.       while (!BIO_eof(fp) && readstanza(&s)) {
2113.           if (s.numpairs == 0)

test/bntest.c:2111:5: variable `s` accessed here
  2109.       /* Read test file. */
  2110.       set_test_title(testfiles[i]);
  2111.       memset(&s, 0, sizeof(s));
              ^
  2112.       while (!BIO_eof(fp) && readstanza(&s)) {
  2113.           if (s.numpairs == 0)

test/bntest.c:2115:14: passed as argument to `file_test_run`
  2113.           if (s.numpairs == 0)
  2114.               continue;
  2115.           if (!file_test_run(&s)) {
                       ^
  2116.               errcnt++;
  2117.           }

test/bntest.c:2068:1: parameter `s` of file_test_run
    2066.   }
    2067.   
    2068. > static int file_test_run(STANZA *s)
    2069.   {
    2070.       static const FILETEST filetests[] = {

test/bntest.c:2115:14: return from call to `file_test_run`
  2113.           if (s.numpairs == 0)
  2114.               continue;
  2115.           if (!file_test_run(&s)) {
                       ^
  2116.               errcnt++;
  2117.           }

test/bntest.c:2118:9: when calling `clearstanza` here
  2116.               errcnt++;
  2117.           }
  2118.           clearstanza(&s);
                  ^
  2119.       }
  2120.       BIO_free(fp);

test/bntest.c:2052:1: parameter `s` of clearstanza
    2050.   }
    2051.   
    2052. > static void clearstanza(STANZA *s)
    2053.   {
    2054.       PAIR *pp = s->pairs;

test/bntest.c:2054:5: assigned
    2052.   static void clearstanza(STANZA *s)
    2053.   {
    2054.       PAIR *pp = s->pairs;
                ^
    2055.       int i = s->numpairs;
    2056.       int start = s->start;

test/bntest.c:2061:9: when calling `CRYPTO_free` here
    2059.       for ( ; --i >= 0; pp++) {
    2060.           OPENSSL_free(pp->key);
    2061.           OPENSSL_free(pp->value);
                    ^
    2062.       }
    2063.       memset(s, 0, sizeof(*s));

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
      251.   }
      252.   
      253. > void CRYPTO_free(void *str, const char *file, int line)
      254.   {
      255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: invalid access occurs here
      267.       }
      268.   #else
      269.       free(str);
                 ^
      270.   #endif
      271.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int run_file_tests(int i)\n{\n    STANZA s;\n    int errcnt = 0;\n    if (!TEST_ptr(fp = BIO_new_file(testfiles[i], "rb")))\n        return 0;\n    set_test_title(testfiles[i]);\n    memset(&s, 0, sizeof(s));\n    while (!BIO_eof(fp) && readstanza(&s)) {\n        if (s.numpairs == 0)\n            continue;\n        if (!file_test_run(&s)) {\n            errcnt++;\n        }\n        clearstanza(&s);\n    }\n    BIO_free(fp);\n    return errcnt == 0;\n}', 'static int file_test_run(STANZA *s)\n{\n    static const FILETEST filetests[] = {\n        {"Sum", file_sum},\n        {"LShift1", file_lshift1},\n        {"LShift", file_lshift},\n        {"RShift", file_rshift},\n        {"Square", file_square},\n        {"Product", file_product},\n        {"Quotient", file_quotient},\n        {"ModMul", file_modmul},\n        {"ModExp", file_modexp},\n        {"Exp", file_exp},\n        {"ModSqrt", file_modsqrt},\n    };\n    int numtests = OSSL_NELEM(filetests);\n    const FILETEST *tp = filetests;\n    for ( ; --numtests >= 0; tp++) {\n        if (findattr(s, tp->name) != NULL) {\n            if (!tp->func(s)) {\n                TEST_info("Failed %s test at %d", tp->name, s->start);\n                return 0;\n            }\n            return 1;\n        }\n    }\n    TEST_info("Unknown test at %d", s->start);\n    return 0;\n}', 'static void clearstanza(STANZA *s)\n{\n    PAIR *pp = s->pairs;\n    int i = s->numpairs;\n    int start = s->start;\n    int curr = s->curr;\n    for ( ; --i >= 0; pp++) {\n        OPENSSL_free(pp->key);\n        OPENSSL_free(pp->value);\n    }\n    memset(s, 0, sizeof(*s));\n    s->curr = curr;\n    s->start = start;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']