crypto/stack/stack.c:220: error: USE_AFTER_FREE
  call to `OPENSSL_sk_free()` eventually accesses memory that was invalidated by call to `free()` on line 219 indirectly during the call to `sk_reserve()`.
Showing all 20 steps of the trace


crypto/stack/stack.c:209:25: invalidation part of the trace starts here
207.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
208.   {
209.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                               ^
210.   
211.       if (st == NULL)

crypto/stack/stack.c:209:25: passed as argument to `CRYPTO_zalloc`
  207.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  208.   {
  209.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  210.   
  211.       if (st == NULL)

crypto/stack/stack.c:209:25: return from call to `CRYPTO_zalloc`
  207.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  208.   {
  209.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  210.   
  211.       if (st == NULL)

crypto/stack/stack.c:209:5: assigned
  207.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  208.   {
  209.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
             ^
  210.   
  211.       if (st == NULL)

crypto/stack/stack.c:219:10: when calling `sk_reserve` here
  217.           return st;
  218.   
  219.       if (!sk_reserve(st, n, 1)) {
                  ^
  220.           OPENSSL_sk_free(st);
  221.           return NULL;

crypto/stack/stack.c:160:1: parameter `st` of sk_reserve
    158.   
    159.   /* internal STACK storage allocation */
    160. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
    161.   {
    162.       const void **tmpdata;

crypto/stack/stack.c:198:15: when calling `CRYPTO_realloc` here
    196.       }
    197.   
    198.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                         ^
    199.       if (tmpdata == NULL)
    200.           return 0;

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
      236.   }
      237.   
      238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      239.   {
      240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
      247.   
      248.       if (num == 0) {
      249.           CRYPTO_free(str, file, line);
                     ^
      250.           return NULL;
      251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
        293.   }
        294.   
        295. > void CRYPTO_free(void *str, const char *file, int line)
        296.   {
        297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
        310.       }
        311.   #else
        312.       free(str);
                   ^
        313.   #endif
        314.   }

crypto/stack/stack.c:209:25: use-after-lifetime part of the trace starts here
207.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
208.   {
209.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                               ^
210.   
211.       if (st == NULL)

crypto/stack/stack.c:209:25: passed as argument to `CRYPTO_zalloc`
  207.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  208.   {
  209.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  210.   
  211.       if (st == NULL)

crypto/stack/stack.c:209:25: return from call to `CRYPTO_zalloc`
  207.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  208.   {
  209.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  210.   
  211.       if (st == NULL)

crypto/stack/stack.c:209:5: assigned
  207.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  208.   {
  209.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
             ^
  210.   
  211.       if (st == NULL)

crypto/stack/stack.c:220:9: when calling `OPENSSL_sk_free` here
  218.   
  219.       if (!sk_reserve(st, n, 1)) {
  220.           OPENSSL_sk_free(st);
                 ^
  221.           return NULL;
  222.       }

crypto/stack/stack.c:372:1: parameter `st` of OPENSSL_sk_free
    370.   }
    371.   
    372. > void OPENSSL_sk_free(OPENSSL_STACK *st)
    373.   {
    374.       if (st == NULL)

crypto/stack/stack.c:376:5: when calling `CRYPTO_free` here
    374.       if (st == NULL)
    375.           return;
    376.       OPENSSL_free(st->data);
               ^
    377.       OPENSSL_free(st);
    378.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
      310.       }
      311.   #else
      312.       free(str);
                 ^
      313.   #endif
      314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)\n{\n    OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));\n    if (st == NULL)\n        return NULL;\n    st->comp = c;\n    if (n <= 0)\n        return st;\n    if (!sk_reserve(st, n, 1)) {\n        OPENSSL_sk_free(st);\n        return NULL;\n    }\n    return st;\n}', 'static int sk_reserve(OPENSSL_STACK *st, int n, int exact)\n{\n    const void **tmpdata;\n    int num_alloc;\n    if (n > max_nodes - st->num)\n        return 0;\n    num_alloc = st->num + n;\n    if (num_alloc < min_nodes)\n        num_alloc = min_nodes;\n    if (st->data == NULL) {\n        if ((st->data = OPENSSL_zalloc(sizeof(void *) * num_alloc)) == NULL) {\n            CRYPTOerr(CRYPTO_F_SK_RESERVE, ERR_R_MALLOC_FAILURE);\n            return 0;\n        }\n        st->num_alloc = num_alloc;\n        return 1;\n    }\n    if (!exact) {\n        if (num_alloc <= st->num_alloc)\n            return 1;\n        num_alloc = compute_growth(num_alloc, st->num_alloc);\n        if (num_alloc == 0)\n            return 0;\n    } else if (num_alloc == st->num_alloc) {\n        return 1;\n    }\n    tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);\n    if (tmpdata == NULL)\n        return 0;\n    st->data = tmpdata;\n    st->num_alloc = num_alloc;\n    return 1;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    INCREMENT(realloc_count);\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}', 'void OPENSSL_sk_free(OPENSSL_STACK *st)\n{\n    if (st == NULL)\n        return;\n    OPENSSL_free(st->data);\n    OPENSSL_free(st);\n}']