crypto/asn1/x_name.c:186: error: USE_AFTER_FREE
  call to `X509_NAME_ENTRY_free()` eventually accesses memory that was invalidated by call to `free()` on line 186 indirectly during the call to `X509_NAME_ENTRY_free()`.
Showing all 16 steps of the trace


crypto/asn1/x_name.c:175:1: invalidation part of the trace starts here
173.   	}
174.   
175. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
176.   	{
177.   	int set=0,i;

crypto/asn1/x_name.c:175:1: parameter `a` of d2i_X509_NAME
  173.   	}
  174.   
  175. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  176.   	{
  177.   	int set=0,i;

crypto/asn1/x_name.c:180:2: assigned
  178.   	int idx=0;
  179.   	unsigned char *orig;
  180.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  181.   
  182.   	orig= *pp;

crypto/asn1/x_name.c:187:12: passed as argument to `sk_X509_NAME_ENTRY_pop`
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  188.   		}
  189.   

crypto/asn1/x_name.c:187:12: return from call to `sk_X509_NAME_ENTRY_pop`
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  188.   		}
  189.   

crypto/asn1/x_name.c:186:4: when calling `X509_NAME_ENTRY_free` here
  184.   		{
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
            ^
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
  188.   		}

crypto/asn1/x_name.c:252:1: parameter `a` of X509_NAME_ENTRY_free
    250.   	}
    251.   
    252. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    253.   	{
    254.   	if (a == NULL) return;

crypto/asn1/x_name.c:257:2: was invalidated by call to `free()`
    255.   	ASN1_OBJECT_free(a->object);
    256.   	ASN1_BIT_STRING_free(a->value);
    257.   	Free(a);
            ^
    258.   	}
    259.   

crypto/asn1/x_name.c:175:1: use-after-lifetime part of the trace starts here
173.   	}
174.   
175. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
176.   	{
177.   	int set=0,i;

crypto/asn1/x_name.c:175:1: parameter `a` of d2i_X509_NAME
  173.   	}
  174.   
  175. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  176.   	{
  177.   	int set=0,i;

crypto/asn1/x_name.c:180:2: assigned
  178.   	int idx=0;
  179.   	unsigned char *orig;
  180.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  181.   
  182.   	orig= *pp;

crypto/asn1/x_name.c:187:12: passed as argument to `sk_X509_NAME_ENTRY_pop`
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  188.   		}
  189.   

crypto/asn1/x_name.c:187:12: return from call to `sk_X509_NAME_ENTRY_pop`
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  188.   		}
  189.   

crypto/asn1/x_name.c:186:4: when calling `X509_NAME_ENTRY_free` here
  184.   		{
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
            ^
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
  188.   		}

crypto/asn1/x_name.c:252:1: parameter `a` of X509_NAME_ENTRY_free
    250.   	}
    251.   
    252. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    253.   	{
    254.   	if (a == NULL) return;

crypto/asn1/x_name.c:257:2: invalid access occurs here
    255.   	ASN1_OBJECT_free(a->object);
    256.   	ASN1_BIT_STRING_free(a->value);
    257.   	Free(a);
            ^
    258.   	}
    259.   

void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
	{
	if (a == NULL) return;
	ASN1_OBJECT_free(a->object);
	ASN1_BIT_STRING_free(a->value);
	Free(a);
	}
['X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)\n\t{\n\tint set=0,i;\n\tint idx=0;\n\tunsigned char *orig;\n\tM_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);\n\torig= *pp;\n\tif (sk_X509_NAME_ENTRY_num(ret->entries) > 0)\n\t\t{\n\t\twhile (sk_X509_NAME_ENTRY_num(ret->entries) > 0)\n\t\t\tX509_NAME_ENTRY_free(\n\t\t\t\t       sk_X509_NAME_ENTRY_pop(ret->entries));\n\t\t}\n\tM_ASN1_D2I_Init();\n\tM_ASN1_D2I_start_sequence();\n\tfor (;;)\n\t\t{\n\t\tif (M_ASN1_D2I_end_sequence()) break;\n\t\tM_ASN1_D2I_get_set_type(X509_NAME_ENTRY,ret->entries,\n\t\t\t\t\td2i_X509_NAME_ENTRY,\n\t\t\t\t\tX509_NAME_ENTRY_free);\n\t\tfor (; idx < sk_X509_NAME_ENTRY_num(ret->entries); idx++)\n\t\t\t{\n\t\t\tsk_X509_NAME_ENTRY_value(ret->entries,idx)->set=set;\n\t\t\t}\n\t\tset++;\n\t\t}\n\ti=(int)(c.p-orig);\n\tif (!BUF_MEM_grow(ret->bytes,i)) goto err;\n\tmemcpy(ret->bytes->data,orig,i);\n\tret->bytes->length=i;\n\tret->modified=0;\n\tM_ASN1_D2I_Finish(a,X509_NAME_free,ASN1_F_D2I_X509_NAME);\n\t}', 'void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)\n\t{\n\tif (a == NULL) return;\n\tASN1_OBJECT_free(a->object);\n\tASN1_BIT_STRING_free(a->value);\n\tFree(a);\n\t}']