crypto/x509v3/v3_pci.c:152: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 138 indirectly during the call to `CRYPTO_realloc()`.
Showing all 12 steps of the trace


crypto/x509v3/v3_pci.c:85:1: invalidation part of the trace starts here
83.   }
84.   
85. > static int process_pci_value(CONF_VALUE *val,
86.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
87.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:85:1: parameter `policy` of process_pci_value
  83.   }
  84.   
  85. > static int process_pci_value(CONF_VALUE *val,
  86.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  87.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:138:24: when calling `CRYPTO_realloc` here
  136.               }
  137.   
  138.               tmp_data = OPENSSL_realloc((*policy)->data,
                                ^
  139.                                          (*policy)->length + val_len + 1);
  140.               if (tmp_data) {

crypto/mem.c:228:1: parameter `str` of CRYPTO_realloc
    226.   }
    227.   
    228. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    229.   {
    230.       INCREMENT(realloc_count);

crypto/mem.c:239:9: when calling `CRYPTO_free` here
    237.   
    238.       if (num == 0) {
    239.           CRYPTO_free(str, file, line);
                   ^
    240.           return NULL;
    241.       }

crypto/mem.c:286:1: parameter `str` of CRYPTO_free
      284.   }
      285.   
      286. > void CRYPTO_free(void *str, const char *file, int line)
      287.   {
      288.       INCREMENT(free_count);

crypto/mem.c:303:5: was invalidated by call to `free()`
      301.       }
      302.   #else
      303.       free(str);
                 ^
      304.   #endif
      305.   }

crypto/x509v3/v3_pci.c:85:1: use-after-lifetime part of the trace starts here
83.   }
84.   
85. > static int process_pci_value(CONF_VALUE *val,
86.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
87.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:85:1: parameter `policy` of process_pci_value
  83.   }
  84.   
  85. > static int process_pci_value(CONF_VALUE *val,
  86.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  87.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:152:17: when calling `CRYPTO_free` here
  150.                    * too!
  151.                    */
  152.                   OPENSSL_free((*policy)->data);
                         ^
  153.                   (*policy)->data = NULL;
  154.                   (*policy)->length = 0;

crypto/mem.c:286:1: parameter `str` of CRYPTO_free
    284.   }
    285.   
    286. > void CRYPTO_free(void *str, const char *file, int line)
    287.   {
    288.       INCREMENT(free_count);

crypto/mem.c:303:5: invalid access occurs here
    301.       }
    302.   #else
    303.       free(str);
               ^
    304.   #endif
    305.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int process_pci_value(CONF_VALUE *val,\n                             ASN1_OBJECT **language, ASN1_INTEGER **pathlen,\n                             ASN1_OCTET_STRING **policy)\n{\n    int free_policy = 0;\n    if (strcmp(val->name, "language") == 0) {\n        if (*language) {\n            X509V3err(X509V3_F_PROCESS_PCI_VALUE,\n                      X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED);\n            X509V3_conf_err(val);\n            return 0;\n        }\n        if ((*language = OBJ_txt2obj(val->value, 0)) == NULL) {\n            X509V3err(X509V3_F_PROCESS_PCI_VALUE,\n                      X509V3_R_INVALID_OBJECT_IDENTIFIER);\n            X509V3_conf_err(val);\n            return 0;\n        }\n    } else if (strcmp(val->name, "pathlen") == 0) {\n        if (*pathlen) {\n            X509V3err(X509V3_F_PROCESS_PCI_VALUE,\n                      X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED);\n            X509V3_conf_err(val);\n            return 0;\n        }\n        if (!X509V3_get_value_int(val, pathlen)) {\n            X509V3err(X509V3_F_PROCESS_PCI_VALUE,\n                      X509V3_R_POLICY_PATH_LENGTH);\n            X509V3_conf_err(val);\n            return 0;\n        }\n    } else if (strcmp(val->name, "policy") == 0) {\n        unsigned char *tmp_data = NULL;\n        long val_len;\n        if (!*policy) {\n            *policy = ASN1_OCTET_STRING_new();\n            if (*policy == NULL) {\n                X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);\n                X509V3_conf_err(val);\n                return 0;\n            }\n            free_policy = 1;\n        }\n        if (strncmp(val->value, "hex:", 4) == 0) {\n            unsigned char *tmp_data2 =\n                OPENSSL_hexstr2buf(val->value + 4, &val_len);\n            if (!tmp_data2) {\n                X509V3_conf_err(val);\n                goto err;\n            }\n            tmp_data = OPENSSL_realloc((*policy)->data,\n                                       (*policy)->length + val_len + 1);\n            if (tmp_data) {\n                (*policy)->data = tmp_data;\n                memcpy(&(*policy)->data[(*policy)->length],\n                       tmp_data2, val_len);\n                (*policy)->length += val_len;\n                (*policy)->data[(*policy)->length] = \'\\0\';\n            } else {\n                OPENSSL_free(tmp_data2);\n                OPENSSL_free((*policy)->data);\n                (*policy)->data = NULL;\n                (*policy)->length = 0;\n                X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);\n                X509V3_conf_err(val);\n                goto err;\n            }\n            OPENSSL_free(tmp_data2);\n        } else if (strncmp(val->value, "file:", 5) == 0) {\n            unsigned char buf[2048];\n            int n;\n            BIO *b = BIO_new_file(val->value + 5, "r");\n            if (!b) {\n                X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_BIO_LIB);\n                X509V3_conf_err(val);\n                goto err;\n            }\n            while ((n = BIO_read(b, buf, sizeof(buf))) > 0\n                   || (n == 0 && BIO_should_retry(b))) {\n                if (!n)\n                    continue;\n                tmp_data = OPENSSL_realloc((*policy)->data,\n                                           (*policy)->length + n + 1);\n                if (!tmp_data) {\n                    OPENSSL_free((*policy)->data);\n                    (*policy)->data = NULL;\n                    (*policy)->length = 0;\n                    X509V3err(X509V3_F_PROCESS_PCI_VALUE,\n                              ERR_R_MALLOC_FAILURE);\n                    X509V3_conf_err(val);\n                    BIO_free_all(b);\n                    goto err;\n                }\n                (*policy)->data = tmp_data;\n                memcpy(&(*policy)->data[(*policy)->length], buf, n);\n                (*policy)->length += n;\n                (*policy)->data[(*policy)->length] = \'\\0\';\n            }\n            BIO_free_all(b);\n            if (n < 0) {\n                X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_BIO_LIB);\n                X509V3_conf_err(val);\n                goto err;\n            }\n        } else if (strncmp(val->value, "text:", 5) == 0) {\n            val_len = strlen(val->value + 5);\n            tmp_data = OPENSSL_realloc((*policy)->data,\n                                       (*policy)->length + val_len + 1);\n            if (tmp_data) {\n                (*policy)->data = tmp_data;\n                memcpy(&(*policy)->data[(*policy)->length],\n                       val->value + 5, val_len);\n                (*policy)->length += val_len;\n                (*policy)->data[(*policy)->length] = \'\\0\';\n            } else {\n                OPENSSL_free((*policy)->data);\n                (*policy)->data = NULL;\n                (*policy)->length = 0;\n                X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);\n                X509V3_conf_err(val);\n                goto err;\n            }\n        } else {\n            X509V3err(X509V3_F_PROCESS_PCI_VALUE,\n                      X509V3_R_INCORRECT_POLICY_SYNTAX_TAG);\n            X509V3_conf_err(val);\n            goto err;\n        }\n        if (!tmp_data) {\n            X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);\n            X509V3_conf_err(val);\n            goto err;\n        }\n    }\n    return 1;\n err:\n    if (free_policy) {\n        ASN1_OCTET_STRING_free(*policy);\n        *policy = NULL;\n    }\n    return 0;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    INCREMENT(realloc_count);\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']