crypto/crmf/crmf_lib.c:236: error: USE_AFTER_FREE
  call to `sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_free()` eventually accesses memory that was invalidated by call to `free()` on line 228 indirectly during the call to `sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_push()`.
Showing all 26 steps of the trace


crypto/crmf/crmf_lib.c:225:31: invalidation part of the trace starts here
223.   
224.       if (crm->regInfo == NULL)
225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                                     ^
226.       if (crm->regInfo == NULL)
227.           goto oom;

crypto/crmf/crmf_lib.c:225:31: passed as argument to `sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null`
  223.   
  224.       if (crm->regInfo == NULL)
  225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                                       ^
  226.       if (crm->regInfo == NULL)
  227.           goto oom;

crypto/crmf/crmf_lib.c:225:31: return from call to `sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null`
  223.   
  224.       if (crm->regInfo == NULL)
  225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                                       ^
  226.       if (crm->regInfo == NULL)
  227.           goto oom;

crypto/crmf/crmf_lib.c:225:24: assigned
  223.   
  224.       if (crm->regInfo == NULL)
  225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                                ^
  226.       if (crm->regInfo == NULL)
  227.           goto oom;

crypto/crmf/crmf_lib.c:225:9: assigned
  223.   
  224.       if (crm->regInfo == NULL)
  225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                 ^
  226.       if (crm->regInfo == NULL)
  227.           goto oom;

crypto/crmf/crmf_lib.c:228:10: when calling `sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_push` here
  226.       if (crm->regInfo == NULL)
  227.           goto oom;
  228.       if (!sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_push(crm->regInfo, ri))
                  ^
  229.           goto oom;
  230.       return 1;

crypto/crmf/crmf_int.h:374:1: parameter `sk` of sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_push
    372.   } /* OSSL_CRMF_ATTRIBUTETYPEANDVALUE */;
    373.   DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)
    374. > DEFINE_STACK_OF(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)
    375.   DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)
    376.   

crypto/crmf/crmf_int.h:374:1: when calling `OPENSSL_sk_push` here
    372.   } /* OSSL_CRMF_ATTRIBUTETYPEANDVALUE */;
    373.   DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)
    374. > DEFINE_STACK_OF(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)
    375.   DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)
    376.   

crypto/stack/stack.c:326:1: parameter `st` of OPENSSL_sk_push
      324.   }
      325.   
      326. > int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)
      327.   {
      328.       if (st == NULL)

crypto/stack/stack.c:330:12: when calling `OPENSSL_sk_insert` here
      328.       if (st == NULL)
      329.           return -1;
      330.       return OPENSSL_sk_insert(st, data, st->num);
                        ^
      331.   }
      332.   

crypto/stack/stack.c:237:1: parameter `st` of OPENSSL_sk_insert
        235.   }
        236.   
        237. > int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)
        238.   {
        239.       if (st == NULL || st->num == max_nodes)

crypto/stack/stack.c:242:10: when calling `sk_reserve` here
        240.           return 0;
        241.   
        242.       if (!sk_reserve(st, 1, 0))
                        ^
        243.           return 0;
        244.   

crypto/stack/stack.c:160:1: parameter `st` of sk_reserve
          158.   
          159.   /* internal STACK storage allocation */
          160. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
          161.   {
          162.       const void **tmpdata;

crypto/stack/stack.c:198:15: when calling `CRYPTO_realloc` here
          196.       }
          197.   
          198.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                               ^
          199.       if (tmpdata == NULL)
          200.           return 0;

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
            236.   }
            237.   
            238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            239.   {
            240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
            247.   
            248.       if (num == 0) {
            249.           CRYPTO_free(str, file, line);
                           ^
            250.           return NULL;
            251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
              293.   }
              294.   
              295. > void CRYPTO_free(void *str, const char *file, int line)
              296.   {
              297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
              310.       }
              311.   #else
              312.       free(str);
                         ^
              313.   #endif
              314.   }

crypto/crmf/crmf_lib.c:225:31: use-after-lifetime part of the trace starts here
223.   
224.       if (crm->regInfo == NULL)
225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                                     ^
226.       if (crm->regInfo == NULL)
227.           goto oom;

crypto/crmf/crmf_lib.c:225:31: passed as argument to `sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null`
  223.   
  224.       if (crm->regInfo == NULL)
  225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                                       ^
  226.       if (crm->regInfo == NULL)
  227.           goto oom;

crypto/crmf/crmf_lib.c:225:31: return from call to `sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null`
  223.   
  224.       if (crm->regInfo == NULL)
  225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                                       ^
  226.       if (crm->regInfo == NULL)
  227.           goto oom;

crypto/crmf/crmf_lib.c:225:24: assigned
  223.   
  224.       if (crm->regInfo == NULL)
  225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                                ^
  226.       if (crm->regInfo == NULL)
  227.           goto oom;

crypto/crmf/crmf_lib.c:225:9: assigned
  223.   
  224.       if (crm->regInfo == NULL)
  225.           crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();
                 ^
  226.       if (crm->regInfo == NULL)
  227.           goto oom;

crypto/crmf/crmf_lib.c:236:5: when calling `sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_free` here
  234.       if (info != NULL)
  235.           crm->regInfo = NULL;
  236.       sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_free(info);
             ^
  237.       return 0;
  238.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int OSSL_CRMF_MSG_push0_regInfo(OSSL_CRMF_MSG *crm,\n                                       OSSL_CRMF_ATTRIBUTETYPEANDVALUE *ri)\n{\n    STACK_OF(OSSL_CRMF_ATTRIBUTETYPEANDVALUE) *info = NULL;\n    if (crm == NULL || ri == NULL) {\n        CRMFerr(CRMF_F_OSSL_CRMF_MSG_PUSH0_REGINFO, CRMF_R_NULL_ARGUMENT);\n        return 0;\n    }\n    if (crm->regInfo == NULL)\n        crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null();\n    if (crm->regInfo == NULL)\n        goto oom;\n    if (!sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_push(crm->regInfo, ri))\n        goto oom;\n    return 1;\n oom:\n    CRMFerr(CRMF_F_OSSL_CRMF_MSG_PUSH0_REGINFO, ERR_R_MALLOC_FAILURE);\n    if (info != NULL)\n        crm->regInfo = NULL;\n    sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_free(info);\n    return 0;\n}', 'DEFINE_STACK_OF(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)', 'int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)\n{\n    if (st == NULL)\n        return -1;\n    return OPENSSL_sk_insert(st, data, st->num);\n}', 'int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)\n{\n    if (st == NULL || st->num == max_nodes)\n        return 0;\n    if (!sk_reserve(st, 1, 0))\n        return 0;\n    if ((loc >= st->num) || (loc < 0)) {\n        st->data[st->num] = data;\n    } else {\n        memmove(&st->data[loc + 1], &st->data[loc],\n                sizeof(st->data[0]) * (st->num - loc));\n        st->data[loc] = data;\n    }\n    st->num++;\n    st->sorted = 0;\n    return st->num;\n}', 'static int sk_reserve(OPENSSL_STACK *st, int n, int exact)\n{\n    const void **tmpdata;\n    int num_alloc;\n    if (n > max_nodes - st->num)\n        return 0;\n    num_alloc = st->num + n;\n    if (num_alloc < min_nodes)\n        num_alloc = min_nodes;\n    if (st->data == NULL) {\n        if ((st->data = OPENSSL_zalloc(sizeof(void *) * num_alloc)) == NULL) {\n            CRYPTOerr(CRYPTO_F_SK_RESERVE, ERR_R_MALLOC_FAILURE);\n            return 0;\n        }\n        st->num_alloc = num_alloc;\n        return 1;\n    }\n    if (!exact) {\n        if (num_alloc <= st->num_alloc)\n            return 1;\n        num_alloc = compute_growth(num_alloc, st->num_alloc);\n        if (num_alloc == 0)\n            return 0;\n    } else if (num_alloc == st->num_alloc) {\n        return 1;\n    }\n    tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);\n    if (tmpdata == NULL)\n        return 0;\n    st->data = tmpdata;\n    st->num_alloc = num_alloc;\n    return 1;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    INCREMENT(realloc_count);\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']