apps/crl2p7.c:159: error: USE_AFTER_FREE
  call to `sk_OPENSSL_STRING_free()` eventually accesses memory that was invalidated by call to `free()` on line 87 indirectly during the call to `sk_OPENSSL_STRING_push()`.
Showing all 24 steps of the trace


apps/crl2p7.c:85:32: invalidation part of the trace starts here
83.           case OPT_CERTFILE:
84.               if ((certflst == NULL)
85.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                     ^
86.                   goto end;
87.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:85:32: passed as argument to `sk_OPENSSL_STRING_new_null`
  83.           case OPT_CERTFILE:
  84.               if ((certflst == NULL)
  85.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                       ^
  86.                   goto end;
  87.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:85:32: return from call to `sk_OPENSSL_STRING_new_null`
  83.           case OPT_CERTFILE:
  84.               if ((certflst == NULL)
  85.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                       ^
  86.                   goto end;
  87.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:85:21: assigned
  83.           case OPT_CERTFILE:
  84.               if ((certflst == NULL)
  85.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                            ^
  86.                   goto end;
  87.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:87:18: when calling `sk_OPENSSL_STRING_push` here
  85.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
  86.                   goto end;
  87.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))
                         ^
  88.                   goto end;
  89.               break;

include/openssl/safestack.h:155:1: parameter `sk` of sk_OPENSSL_STRING_push
    153.    * dealt with in the autogenerated macros below.
    154.    */
    155. > DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char)
    156.   DEFINE_SPECIAL_STACK_OF_CONST(OPENSSL_CSTRING, char)
    157.   

include/openssl/safestack.h:155:1: when calling `OPENSSL_sk_push` here
    153.    * dealt with in the autogenerated macros below.
    154.    */
    155. > DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char)
    156.   DEFINE_SPECIAL_STACK_OF_CONST(OPENSSL_CSTRING, char)
    157.   

crypto/stack/stack.c:305:1: parameter `st` of OPENSSL_sk_push
      303.   }
      304.   
      305. > int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)
      306.   {
      307.       if (st == NULL)

crypto/stack/stack.c:309:12: when calling `OPENSSL_sk_insert` here
      307.       if (st == NULL)
      308.           return -1;
      309.       return OPENSSL_sk_insert(st, data, st->num);
                        ^
      310.   }
      311.   

crypto/stack/stack.c:216:1: parameter `st` of OPENSSL_sk_insert
        214.   }
        215.   
        216. > int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)
        217.   {
        218.       if (st == NULL || st->num == max_nodes)

crypto/stack/stack.c:221:10: when calling `sk_reserve` here
        219.           return 0;
        220.   
        221.       if (!sk_reserve(st, 1, 0))
                        ^
        222.           return 0;
        223.   

crypto/stack/stack.c:160:1: parameter `st` of sk_reserve
          158.   
          159.   /* internal STACK storage allocation */
          160. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
          161.   {
          162.       const void **tmpdata;

crypto/stack/stack.c:197:15: when calling `CRYPTO_realloc` here
          195.       }
          196.   
          197.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                               ^
          198.       if (tmpdata == NULL)
          199.           return 0;

crypto/mem.c:208:1: parameter `str` of CRYPTO_realloc
            206.   }
            207.   
            208. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            209.   {
            210.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:218:9: when calling `CRYPTO_free` here
            216.   
            217.       if (num == 0) {
            218.           CRYPTO_free(str, file, line);
                           ^
            219.           return NULL;
            220.       }

crypto/mem.c:265:1: parameter `str` of CRYPTO_free
              263.   }
              264.   
              265. > void CRYPTO_free(void *str, const char *file, int line)
              266.   {
              267.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:281:5: was invalidated by call to `free()`
              279.       }
              280.   #else
              281.       free(str);
                         ^
              282.   #endif
              283.   }

apps/crl2p7.c:85:32: use-after-lifetime part of the trace starts here
83.           case OPT_CERTFILE:
84.               if ((certflst == NULL)
85.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                     ^
86.                   goto end;
87.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:85:32: passed as argument to `sk_OPENSSL_STRING_new_null`
  83.           case OPT_CERTFILE:
  84.               if ((certflst == NULL)
  85.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                       ^
  86.                   goto end;
  87.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:85:32: return from call to `sk_OPENSSL_STRING_new_null`
  83.           case OPT_CERTFILE:
  84.               if ((certflst == NULL)
  85.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                       ^
  86.                   goto end;
  87.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:85:21: assigned
  83.           case OPT_CERTFILE:
  84.               if ((certflst == NULL)
  85.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                            ^
  86.                   goto end;
  87.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:159:5: when calling `sk_OPENSSL_STRING_free` here
  157.       ret = 0;
  158.    end:
  159.       sk_OPENSSL_STRING_free(certflst);
             ^
  160.       BIO_free(in);
  161.       BIO_free_all(out);

crypto/mem.c:265:1: parameter `str` of CRYPTO_free
    263.   }
    264.   
    265. > void CRYPTO_free(void *str, const char *file, int line)
    266.   {
    267.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:281:5: invalid access occurs here
    279.       }
    280.   #else
    281.       free(str);
               ^
    282.   #endif
    283.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['int crl2pkcs7_main(int argc, char **argv)\n{\n    BIO *in = NULL, *out = NULL;\n    PKCS7 *p7 = NULL;\n    PKCS7_SIGNED *p7s = NULL;\n    STACK_OF(OPENSSL_STRING) *certflst = NULL;\n    STACK_OF(X509) *cert_stack = NULL;\n    STACK_OF(X509_CRL) *crl_stack = NULL;\n    X509_CRL *crl = NULL;\n    char *infile = NULL, *outfile = NULL, *prog, *certfile;\n    int i = 0, informat = FORMAT_PEM, outformat = FORMAT_PEM, ret = 1, nocrl =\n        0;\n    OPTION_CHOICE o;\n    prog = opt_init(argc, argv, crl2pkcs7_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n        case OPT_EOF:\n        case OPT_ERR:\n opthelp:\n            BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n            goto end;\n        case OPT_HELP:\n            opt_help(crl2pkcs7_options);\n            ret = 0;\n            goto end;\n        case OPT_INFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))\n                goto opthelp;\n            break;\n        case OPT_OUTFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))\n                goto opthelp;\n            break;\n        case OPT_IN:\n            infile = opt_arg();\n            break;\n        case OPT_OUT:\n            outfile = opt_arg();\n            break;\n        case OPT_NOCRL:\n            nocrl = 1;\n            break;\n        case OPT_CERTFILE:\n            if ((certflst == NULL)\n                && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)\n                goto end;\n            if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))\n                goto end;\n            break;\n        }\n    }\n    argc = opt_num_rest();\n    if (argc != 0)\n        goto opthelp;\n    if (!nocrl) {\n        in = bio_open_default(infile, \'r\', informat);\n        if (in == NULL)\n            goto end;\n        if (informat == FORMAT_ASN1)\n            crl = d2i_X509_CRL_bio(in, NULL);\n        else if (informat == FORMAT_PEM)\n            crl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);\n        if (crl == NULL) {\n            BIO_printf(bio_err, "unable to load CRL\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    if ((p7 = PKCS7_new()) == NULL)\n        goto end;\n    if ((p7s = PKCS7_SIGNED_new()) == NULL)\n        goto end;\n    p7->type = OBJ_nid2obj(NID_pkcs7_signed);\n    p7->d.sign = p7s;\n    p7s->contents->type = OBJ_nid2obj(NID_pkcs7_data);\n    if (!ASN1_INTEGER_set(p7s->version, 1))\n        goto end;\n    if ((crl_stack = sk_X509_CRL_new_null()) == NULL)\n        goto end;\n    p7s->crl = crl_stack;\n    if (crl != NULL) {\n        sk_X509_CRL_push(crl_stack, crl);\n        crl = NULL;\n    }\n    if ((cert_stack = sk_X509_new_null()) == NULL)\n        goto end;\n    p7s->cert = cert_stack;\n    if (certflst != NULL)\n        for (i = 0; i < sk_OPENSSL_STRING_num(certflst); i++) {\n            certfile = sk_OPENSSL_STRING_value(certflst, i);\n            if (add_certs_from_file(cert_stack, certfile) < 0) {\n                BIO_printf(bio_err, "error loading certificates\\n");\n                ERR_print_errors(bio_err);\n                goto end;\n            }\n        }\n    out = bio_open_default(outfile, \'w\', outformat);\n    if (out == NULL)\n        goto end;\n    if (outformat == FORMAT_ASN1)\n        i = i2d_PKCS7_bio(out, p7);\n    else if (outformat == FORMAT_PEM)\n        i = PEM_write_bio_PKCS7(out, p7);\n    if (!i) {\n        BIO_printf(bio_err, "unable to write pkcs7 object\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    ret = 0;\n end:\n    sk_OPENSSL_STRING_free(certflst);\n    BIO_free(in);\n    BIO_free_all(out);\n    PKCS7_free(p7);\n    X509_CRL_free(crl);\n    return (ret);\n}', 'DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char)', 'int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)\n{\n    if (st == NULL)\n        return -1;\n    return OPENSSL_sk_insert(st, data, st->num);\n}', 'int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)\n{\n    if (st == NULL || st->num == max_nodes)\n        return 0;\n    if (!sk_reserve(st, 1, 0))\n        return 0;\n    if ((loc >= st->num) || (loc < 0)) {\n        st->data[st->num] = data;\n    } else {\n        memmove(&st->data[loc + 1], &st->data[loc],\n                sizeof(st->data[0]) * (st->num - loc));\n        st->data[loc] = data;\n    }\n    st->num++;\n    st->sorted = 0;\n    return st->num;\n}', 'static int sk_reserve(OPENSSL_STACK *st, int n, int exact)\n{\n    const void **tmpdata;\n    int num_alloc;\n    if (n > max_nodes - st->num)\n        return 0;\n    num_alloc = st->num + n;\n    if (num_alloc < min_nodes)\n        num_alloc = min_nodes;\n    if (st->data == NULL) {\n        st->data = OPENSSL_zalloc(sizeof(void *) * num_alloc);\n        if (st->data == NULL)\n            return 0;\n        st->num_alloc = num_alloc;\n        return 1;\n    }\n    if (!exact) {\n        if (num_alloc <= st->num_alloc)\n            return 1;\n        num_alloc = compute_growth(num_alloc, st->num_alloc);\n        if (num_alloc == 0)\n            return 0;\n    } else if (num_alloc == st->num_alloc) {\n        return 1;\n    }\n    tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);\n    if (tmpdata == NULL)\n        return 0;\n    st->data = tmpdata;\n    st->num_alloc = num_alloc;\n    return 1;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']