crypto/stack/stack.c:106: error: USE_AFTER_FREE
  call to `sk_free()` eventually accesses memory that was invalidated by call to `free()` on line 93 indirectly during the call to `CRYPTO_realloc()`.
Showing all 14 steps of the trace


crypto/stack/stack.c:91:10: invalidation part of the trace starts here
89.       char **s;
90.   
91.       if ((ret = sk_new(sk->comp)) == NULL)
               ^
92.           goto err;
93.       s = OPENSSL_realloc((char *)ret->data,

crypto/stack/stack.c:91:10: assigned
  89.       char **s;
  90.   
  91.       if ((ret = sk_new(sk->comp)) == NULL)
                 ^
  92.           goto err;
  93.       s = OPENSSL_realloc((char *)ret->data,

crypto/stack/stack.c:93:9: when calling `CRYPTO_realloc` here
  91.       if ((ret = sk_new(sk->comp)) == NULL)
  92.           goto err;
  93.       s = OPENSSL_realloc((char *)ret->data,
                ^
  94.                           (unsigned int)sizeof(char *) * sk->num_alloc);
  95.       if (s == NULL)

crypto/mem.c:165:1: parameter `str` of CRYPTO_realloc
    163.   }
    164.   
    165. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    166.   {
    167.       if (str == NULL)

crypto/mem.c:171:9: when calling `CRYPTO_free` here
    169.   
    170.       if (num == 0) {
    171.           CRYPTO_free(str);
                   ^
    172.           return NULL;
    173.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }

crypto/stack/stack.c:91:10: use-after-lifetime part of the trace starts here
89.       char **s;
90.   
91.       if ((ret = sk_new(sk->comp)) == NULL)
               ^
92.           goto err;
93.       s = OPENSSL_realloc((char *)ret->data,

crypto/stack/stack.c:91:10: assigned
  89.       char **s;
  90.   
  91.       if ((ret = sk_new(sk->comp)) == NULL)
                 ^
  92.           goto err;
  93.       s = OPENSSL_realloc((char *)ret->data,

crypto/stack/stack.c:106:5: when calling `sk_free` here
  104.       return (ret);
  105.    err:
  106.       sk_free(ret);
             ^
  107.       return (NULL);
  108.   }

crypto/stack/stack.c:308:1: parameter `st` of sk_free
    306.   }
    307.   
    308. > void sk_free(_STACK *st)
    309.   {
    310.       if (st == NULL)

crypto/stack/stack.c:312:5: when calling `CRYPTO_free` here
    310.       if (st == NULL)
    311.           return;
    312.       OPENSSL_free(st->data);
               ^
    313.       OPENSSL_free(st);
    314.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }

void CRYPTO_free(void *str)
{
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0);
        free(str);
        CRYPTO_mem_debug_free(str, 1);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['_STACK *sk_dup(_STACK *sk)\n{\n    _STACK *ret;\n    char **s;\n    if ((ret = sk_new(sk->comp)) == NULL)\n        goto err;\n    s = OPENSSL_realloc((char *)ret->data,\n                        (unsigned int)sizeof(char *) * sk->num_alloc);\n    if (s == NULL)\n        goto err;\n    ret->data = s;\n    ret->num = sk->num;\n    memcpy(ret->data, sk->data, sizeof(char *) * sk->num);\n    ret->sorted = sk->sorted;\n    ret->num_alloc = sk->num_alloc;\n    ret->comp = sk->comp;\n    return (ret);\n err:\n    sk_free(ret);\n    return (NULL);\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)file;\n    (void)line;\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str)\n{\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}', 'void sk_free(_STACK *st)\n{\n    if (st == NULL)\n        return;\n    OPENSSL_free(st->data);\n    OPENSSL_free(st);\n}']