test/bntest.c:2232: error: USE_AFTER_FREE
  call to `clearstanza()` eventually accesses memory that was invalidated by call to `free()` on line 2232 indirectly during the call to `clearstanza()`.
Showing all 16 steps of the trace


test/bntest.c:2224:5: invalidation part of the trace starts here
2222.   
2223.       /* Read test file. */
2224.       memset(&s, 0, sizeof(s));
            ^
2225.       while (!feof(fp) && readstanza(&s, &linesread)) {
2226.           if (s.numpairs == 0)

test/bntest.c:2224:5: variable `s` accessed here
  2222.   
  2223.       /* Read test file. */
  2224.       memset(&s, 0, sizeof(s));
              ^
  2225.       while (!feof(fp) && readstanza(&s, &linesread)) {
  2226.           if (s.numpairs == 0)

test/bntest.c:2232:9: when calling `clearstanza` here
  2230.               errcnt++;
  2231.           }
  2232.           clearstanza(&s);
                  ^
  2233.           s.start = linesread;
  2234.       }

test/bntest.c:2178:1: parameter `s` of clearstanza
    2176.   }
    2177.   
    2178. > static void clearstanza(STANZA *s)
    2179.   {
    2180.       PAIR *pp = s->pairs;

test/bntest.c:2180:5: assigned
    2178.   static void clearstanza(STANZA *s)
    2179.   {
    2180.       PAIR *pp = s->pairs;
                ^
    2181.       int i = s->numpairs;
    2182.       int start = s->start;

test/bntest.c:2185:9: when calling `CRYPTO_free` here
    2183.   
    2184.       for ( ; --i >= 0; pp++) {
    2185.           OPENSSL_free(pp->key);
                    ^
    2186.           OPENSSL_free(pp->value);
    2187.       }

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
      251.   }
      252.   
      253. > void CRYPTO_free(void *str, const char *file, int line)
      254.   {
      255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: was invalidated by call to `free()`
      267.       }
      268.   #else
      269.       free(str);
                 ^
      270.   #endif
      271.   }

test/bntest.c:2224:5: use-after-lifetime part of the trace starts here
2222.   
2223.       /* Read test file. */
2224.       memset(&s, 0, sizeof(s));
            ^
2225.       while (!feof(fp) && readstanza(&s, &linesread)) {
2226.           if (s.numpairs == 0)

test/bntest.c:2224:5: variable `s` accessed here
  2222.   
  2223.       /* Read test file. */
  2224.       memset(&s, 0, sizeof(s));
              ^
  2225.       while (!feof(fp) && readstanza(&s, &linesread)) {
  2226.           if (s.numpairs == 0)

test/bntest.c:2232:9: when calling `clearstanza` here
  2230.               errcnt++;
  2231.           }
  2232.           clearstanza(&s);
                  ^
  2233.           s.start = linesread;
  2234.       }

test/bntest.c:2178:1: parameter `s` of clearstanza
    2176.   }
    2177.   
    2178. > static void clearstanza(STANZA *s)
    2179.   {
    2180.       PAIR *pp = s->pairs;

test/bntest.c:2180:5: assigned
    2178.   static void clearstanza(STANZA *s)
    2179.   {
    2180.       PAIR *pp = s->pairs;
                ^
    2181.       int i = s->numpairs;
    2182.       int start = s->start;

test/bntest.c:2185:9: when calling `CRYPTO_free` here
    2183.   
    2184.       for ( ; --i >= 0; pp++) {
    2185.           OPENSSL_free(pp->key);
                    ^
    2186.           OPENSSL_free(pp->value);
    2187.       }

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
      251.   }
      252.   
      253. > void CRYPTO_free(void *str, const char *file, int line)
      254.   {
      255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: invalid access occurs here
      267.       }
      268.   #else
      269.       free(str);
                 ^
      270.   #endif
      271.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int file_tests()\n{\n    STANZA s;\n    int linesread = 0, errcnt = 0;\n    memset(&s, 0, sizeof(s));\n    while (!feof(fp) && readstanza(&s, &linesread)) {\n        if (s.numpairs == 0)\n            continue;\n        if (!file_test_run(&s)) {\n            fprintf(stderr, "Test at %d failed\\n", s.start);\n            errcnt++;\n        }\n        clearstanza(&s);\n        s.start = linesread;\n    }\n    return errcnt == 0;\n}', 'static void clearstanza(STANZA *s)\n{\n    PAIR *pp = s->pairs;\n    int i = s->numpairs;\n    int start = s->start;\n    for ( ; --i >= 0; pp++) {\n        OPENSSL_free(pp->key);\n        OPENSSL_free(pp->value);\n    }\n    memset(s, 0, sizeof(*s));\n    s->start = start;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']