apps/s_client.c:532: error: USE_AFTER_FREE
  call to `tlsa_import_rr()` eventually accesses memory that was invalidated by call to `free()` on line 532 indirectly during the call to `tlsa_import_rr()`.
Showing all 14 steps of the trace


apps/s_client.c:532:13: invalidation part of the trace starts here
530.       for (i = 0; i < num; ++i) {
531.           char *rrdata = sk_OPENSSL_STRING_value(rrset, i);
532.           if (tlsa_import_rr(con, rrdata) > 0)
                   ^
533.               ++count;
534.       }

apps/s_client.c:532:13: global variable `tlsa_import_rr.data` accessed here
  530.       for (i = 0; i < num; ++i) {
  531.           char *rrdata = sk_OPENSSL_STRING_value(rrset, i);
  532.           if (tlsa_import_rr(con, rrdata) > 0)
                     ^
  533.               ++count;
  534.       }

apps/s_client.c:532:13: when calling `tlsa_import_rr` here
  530.       for (i = 0; i < num; ++i) {
  531.           char *rrdata = sk_OPENSSL_STRING_value(rrset, i);
  532.           if (tlsa_import_rr(con, rrdata) > 0)
                     ^
  533.               ++count;
  534.       }

apps/s_client.c:489:9: global variable `tlsa_import_rr.data` accessed here
    487.           { &selector, "selector", checked_uint8 },
    488.           { &mtype, "mtype", checked_uint8 },
    489.           { &data, "data", hexdecode },
                   ^
    490.           { NULL, }
    491.       };

apps/s_client.c:507:5: when calling `CRYPTO_free` here
    505.       /* The data field is last, so len is its length */
    506.       ret = SSL_dane_tlsa_add(con, usage, selector, mtype, data, len);
    507.       OPENSSL_free(data);
               ^
    508.   
    509.       if (ret == 0) {

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
      161.   }
      162.   
      163. > void CRYPTO_free(void *str, const char *file, int line)
      164.   {
      165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
      177.       }
      178.   #else
      179.       free(str);
                 ^
      180.   #endif
      181.   }

apps/s_client.c:532:13: use-after-lifetime part of the trace starts here
530.       for (i = 0; i < num; ++i) {
531.           char *rrdata = sk_OPENSSL_STRING_value(rrset, i);
532.           if (tlsa_import_rr(con, rrdata) > 0)
                   ^
533.               ++count;
534.       }

apps/s_client.c:532:13: global variable `tlsa_import_rr.data` accessed here
  530.       for (i = 0; i < num; ++i) {
  531.           char *rrdata = sk_OPENSSL_STRING_value(rrset, i);
  532.           if (tlsa_import_rr(con, rrdata) > 0)
                     ^
  533.               ++count;
  534.       }

apps/s_client.c:532:13: when calling `tlsa_import_rr` here
  530.       for (i = 0; i < num; ++i) {
  531.           char *rrdata = sk_OPENSSL_STRING_value(rrset, i);
  532.           if (tlsa_import_rr(con, rrdata) > 0)
                     ^
  533.               ++count;
  534.       }

apps/s_client.c:489:9: global variable `tlsa_import_rr.data` accessed here
    487.           { &selector, "selector", checked_uint8 },
    488.           { &mtype, "mtype", checked_uint8 },
    489.           { &data, "data", hexdecode },
                   ^
    490.           { NULL, }
    491.       };

apps/s_client.c:507:5: when calling `CRYPTO_free` here
    505.       /* The data field is last, so len is its length */
    506.       ret = SSL_dane_tlsa_add(con, usage, selector, mtype, data, len);
    507.       OPENSSL_free(data);
               ^
    508.   
    509.       if (ret == 0) {

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
      161.   }
      162.   
      163. > void CRYPTO_free(void *str, const char *file, int line)
      164.   {
      165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: invalid access occurs here
      177.       }
      178.   #else
      179.       free(str);
                 ^
      180.   #endif
      181.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int tlsa_import_rrset(SSL *con, STACK_OF(OPENSSL_STRING) *rrset)\n{\n    int num = sk_OPENSSL_STRING_num(rrset);\n    int count = 0;\n    int i;\n    for (i = 0; i < num; ++i) {\n        char *rrdata = sk_OPENSSL_STRING_value(rrset, i);\n        if (tlsa_import_rr(con, rrdata) > 0)\n            ++count;\n    }\n    return count > 0;\n}', 'static int tlsa_import_rr(SSL *con, const char *rrdata)\n{\n    static uint8_t usage;\n    static uint8_t selector;\n    static uint8_t mtype;\n    static unsigned char *data;\n    static struct tlsa_field tlsa_fields[] = {\n        { &usage, "usage", checked_uint8 },\n        { &selector, "selector", checked_uint8 },\n        { &mtype, "mtype", checked_uint8 },\n        { &data, "data", hexdecode },\n        { NULL, }\n    };\n    struct tlsa_field *f;\n    int ret;\n    const char *cp = rrdata;\n    ossl_ssize_t len = 0;\n    for (f = tlsa_fields; f->var; ++f) {\n        if ((len = f->parser(&cp, f->var)) <= 0) {\n            BIO_printf(bio_err, "%s: warning: bad TLSA %s field in: %s\\n",\n                       prog, f->name, rrdata);\n            return 0;\n        }\n    }\n    ret = SSL_dane_tlsa_add(con, usage, selector, mtype, data, len);\n    OPENSSL_free(data);\n    if (ret == 0) {\n        ERR_print_errors(bio_err);\n        BIO_printf(bio_err, "%s: warning: unusable TLSA rrdata: %s\\n",\n                   prog, rrdata);\n        return 0;\n    }\n    if (ret < 0) {\n        ERR_print_errors(bio_err);\n        BIO_printf(bio_err, "%s: warning: error loading TLSA rrdata: %s\\n",\n                   prog, rrdata);\n        return 0;\n    }\n    return ret;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']