test/ssltest_old.c:2788: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 2787 indirectly during the call to `CRYPTO_free()`.
Showing all 18 steps of the trace


test/ssltest_old.c:2532:14: invalidation part of the trace starts here
2530.       int err_in_server = 0;
2531.   
2532.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2533.   
2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2532:14: assigned
  2530.       int err_in_server = 0;
  2531.   
  2532.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2533.   
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2532:5: assigned
  2530.       int err_in_server = 0;
  2531.   
  2532.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2533.   
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2534:17: passed as argument to `CRYPTO_zalloc`
  2532.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2533.   
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2535.           goto err;
  2536.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2534:17: return from call to `CRYPTO_zalloc`
  2532.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2533.   
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2535.           goto err;
  2536.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2534:10: assigned
  2532.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2533.   
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2535.           goto err;
  2536.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2787:5: when calling `CRYPTO_free` here
  2785.       BIO_free_all(c_bio);
  2786.       BIO_free_all(s_bio);
  2787.       OPENSSL_free(cbuf);
              ^
  2788.       OPENSSL_free(sbuf);
  2789.   

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
    251.   }
    252.   
    253. > void CRYPTO_free(void *str, const char *file, int line)
    254.   {
    255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: was invalidated by call to `free()`
    267.       }
    268.   #else
    269.       free(str);
               ^
    270.   #endif
    271.   }

test/ssltest_old.c:2532:14: use-after-lifetime part of the trace starts here
2530.       int err_in_server = 0;
2531.   
2532.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2533.   
2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2532:14: assigned
  2530.       int err_in_server = 0;
  2531.   
  2532.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2533.   
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2532:5: assigned
  2530.       int err_in_server = 0;
  2531.   
  2532.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2533.   
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2536:17: passed as argument to `CRYPTO_zalloc`
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2535.           goto err;
  2536.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2537.           goto err;
  2538.   

test/ssltest_old.c:2536:17: return from call to `CRYPTO_zalloc`
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2535.           goto err;
  2536.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2537.           goto err;
  2538.   

test/ssltest_old.c:2536:10: assigned
  2534.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2535.           goto err;
  2536.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2537.           goto err;
  2538.   

test/ssltest_old.c:2788:5: when calling `CRYPTO_free` here
  2786.       BIO_free_all(s_bio);
  2787.       OPENSSL_free(cbuf);
  2788.       OPENSSL_free(sbuf);
              ^
  2789.   
  2790.       if (should_negotiate != NULL && strcmp(should_negotiate, "fail-client") == 0)

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
    251.   }
    252.   
    253. > void CRYPTO_free(void *str, const char *file, int line)
    254.   {
    255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: invalid access occurs here
    267.       }
    268.   #else
    269.       free(str);
               ^
    270.   #endif
    271.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['int doit(SSL *s_ssl, SSL *c_ssl, long count)\n{\n    char *cbuf = NULL, *sbuf = NULL;\n    long bufsiz;\n    long cw_num = count, cr_num = count;\n    long sw_num = count, sr_num = count;\n    int ret = 1;\n    BIO *c_to_s = NULL;\n    BIO *s_to_c = NULL;\n    BIO *c_bio = NULL;\n    BIO *s_bio = NULL;\n    int c_r, c_w, s_r, s_w;\n    int i, j;\n    int done = 0;\n    int c_write, s_write;\n    int do_server = 0, do_client = 0;\n    int max_frag = 5 * 1024;\n    int err_in_client = 0;\n    int err_in_server = 0;\n    bufsiz = count > 40 * 1024 ? 40 * 1024 : count;\n    if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)\n        goto err;\n    if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)\n        goto err;\n    c_to_s = BIO_new(BIO_s_mem());\n    s_to_c = BIO_new(BIO_s_mem());\n    if ((s_to_c == NULL) || (c_to_s == NULL)) {\n        ERR_print_errors(bio_err);\n        goto err;\n    }\n    c_bio = BIO_new(BIO_f_ssl());\n    s_bio = BIO_new(BIO_f_ssl());\n    if ((c_bio == NULL) || (s_bio == NULL)) {\n        ERR_print_errors(bio_err);\n        goto err;\n    }\n    SSL_set_connect_state(c_ssl);\n    SSL_set_bio(c_ssl, s_to_c, c_to_s);\n    SSL_set_max_send_fragment(c_ssl, max_frag);\n    BIO_set_ssl(c_bio, c_ssl, BIO_NOCLOSE);\n    if (!BIO_up_ref(c_to_s)) {\n        c_to_s = NULL;\n        s_to_c = NULL;\n        goto err;\n    }\n    if (!BIO_up_ref(s_to_c)) {\n        s_to_c = NULL;\n        goto err;\n    }\n    SSL_set_accept_state(s_ssl);\n    SSL_set_bio(s_ssl, c_to_s, s_to_c);\n    c_to_s = NULL;\n    s_to_c = NULL;\n    SSL_set_max_send_fragment(s_ssl, max_frag);\n    BIO_set_ssl(s_bio, s_ssl, BIO_NOCLOSE);\n    c_r = 0;\n    s_r = 1;\n    c_w = 1;\n    s_w = 0;\n    c_write = 1, s_write = 0;\n    for (;;) {\n        do_server = 0;\n        do_client = 0;\n        i = (int)BIO_pending(s_bio);\n        if ((i && s_r) || s_w)\n            do_server = 1;\n        i = (int)BIO_pending(c_bio);\n        if ((i && c_r) || c_w)\n            do_client = 1;\n        if (do_server && debug) {\n            if (SSL_in_init(s_ssl))\n                printf("server waiting in SSL_accept - %s\\n",\n                       SSL_state_string_long(s_ssl));\n        }\n        if (do_client && debug) {\n            if (SSL_in_init(c_ssl))\n                printf("client waiting in SSL_connect - %s\\n",\n                       SSL_state_string_long(c_ssl));\n        }\n        if (!do_client && !do_server) {\n            fprintf(stdout, "ERROR IN STARTUP\\n");\n            ERR_print_errors(bio_err);\n            goto err;\n        }\n        if (do_client && !(done & C_DONE)) {\n            if (c_write) {\n                j = (cw_num > bufsiz) ? (int)bufsiz : (int)cw_num;\n                i = BIO_write(c_bio, cbuf, j);\n                if (i < 0) {\n                    c_r = 0;\n                    c_w = 0;\n                    if (BIO_should_retry(c_bio)) {\n                        if (BIO_should_read(c_bio))\n                            c_r = 1;\n                        if (BIO_should_write(c_bio))\n                            c_w = 1;\n                    } else {\n                        fprintf(stderr, "ERROR in CLIENT\\n");\n                        err_in_client = 1;\n                        ERR_print_errors(bio_err);\n                        goto err;\n                    }\n                } else if (i == 0) {\n                    fprintf(stderr, "SSL CLIENT STARTUP FAILED\\n");\n                    goto err;\n                } else {\n                    if (debug)\n                        printf("client wrote %d\\n", i);\n                    s_r = 1;\n                    c_write = 0;\n                    cw_num -= i;\n                    if (max_frag > 1029)\n                        SSL_set_max_send_fragment(c_ssl, max_frag -= 5);\n                }\n            } else {\n                i = BIO_read(c_bio, cbuf, bufsiz);\n                if (i < 0) {\n                    c_r = 0;\n                    c_w = 0;\n                    if (BIO_should_retry(c_bio)) {\n                        if (BIO_should_read(c_bio))\n                            c_r = 1;\n                        if (BIO_should_write(c_bio))\n                            c_w = 1;\n                    } else {\n                        fprintf(stderr, "ERROR in CLIENT\\n");\n                        err_in_client = 1;\n                        ERR_print_errors(bio_err);\n                        goto err;\n                    }\n                } else if (i == 0) {\n                    fprintf(stderr, "SSL CLIENT STARTUP FAILED\\n");\n                    goto err;\n                } else {\n                    if (debug)\n                        printf("client read %d\\n", i);\n                    cr_num -= i;\n                    if (sw_num > 0) {\n                        s_write = 1;\n                        s_w = 1;\n                    }\n                    if (cr_num <= 0) {\n                        s_write = 1;\n                        s_w = 1;\n                        done = S_DONE | C_DONE;\n                    }\n                }\n            }\n        }\n        if (do_server && !(done & S_DONE)) {\n            if (!s_write) {\n                i = BIO_read(s_bio, sbuf, bufsiz);\n                if (i < 0) {\n                    s_r = 0;\n                    s_w = 0;\n                    if (BIO_should_retry(s_bio)) {\n                        if (BIO_should_read(s_bio))\n                            s_r = 1;\n                        if (BIO_should_write(s_bio))\n                            s_w = 1;\n                    } else {\n                        fprintf(stderr, "ERROR in SERVER\\n");\n                        err_in_server = 1;\n                        ERR_print_errors(bio_err);\n                        goto err;\n                    }\n                } else if (i == 0) {\n                    ERR_print_errors(bio_err);\n                    fprintf(stderr,\n                            "SSL SERVER STARTUP FAILED in SSL_read\\n");\n                    goto err;\n                } else {\n                    if (debug)\n                        printf("server read %d\\n", i);\n                    sr_num -= i;\n                    if (cw_num > 0) {\n                        c_write = 1;\n                        c_w = 1;\n                    }\n                    if (sr_num <= 0) {\n                        s_write = 1;\n                        s_w = 1;\n                        c_write = 0;\n                    }\n                }\n            } else {\n                j = (sw_num > bufsiz) ? (int)bufsiz : (int)sw_num;\n                i = BIO_write(s_bio, sbuf, j);\n                if (i < 0) {\n                    s_r = 0;\n                    s_w = 0;\n                    if (BIO_should_retry(s_bio)) {\n                        if (BIO_should_read(s_bio))\n                            s_r = 1;\n                        if (BIO_should_write(s_bio))\n                            s_w = 1;\n                    } else {\n                        fprintf(stderr, "ERROR in SERVER\\n");\n                        err_in_server = 1;\n                        ERR_print_errors(bio_err);\n                        goto err;\n                    }\n                } else if (i == 0) {\n                    ERR_print_errors(bio_err);\n                    fprintf(stderr,\n                            "SSL SERVER STARTUP FAILED in SSL_write\\n");\n                    goto err;\n                } else {\n                    if (debug)\n                        printf("server wrote %d\\n", i);\n                    sw_num -= i;\n                    s_write = 0;\n                    c_r = 1;\n                    if (sw_num <= 0)\n                        done |= S_DONE;\n                    if (max_frag > 1029)\n                        SSL_set_max_send_fragment(s_ssl, max_frag -= 5);\n                }\n            }\n        }\n        if ((done & S_DONE) && (done & C_DONE))\n            break;\n    }\n    if (verbose)\n        print_details(c_ssl, "DONE: ");\n#ifndef OPENSSL_NO_NEXTPROTONEG\n    if (verify_npn(c_ssl, s_ssl) < 0) {\n        ret = 1;\n        goto err;\n    }\n#endif\n    if (verify_serverinfo() < 0) {\n        fprintf(stderr, "Server info verify error\\n");\n        ret = 1;\n        goto err;\n    }\n    if (custom_ext_error) {\n        fprintf(stderr, "Custom extension error\\n");\n        ret = 1;\n        goto err;\n    }\n    ret = 0;\n err:\n    BIO_free(c_to_s);\n    BIO_free(s_to_c);\n    BIO_free_all(c_bio);\n    BIO_free_all(s_bio);\n    OPENSSL_free(cbuf);\n    OPENSSL_free(sbuf);\n    if (should_negotiate != NULL && strcmp(should_negotiate, "fail-client") == 0)\n        ret = (err_in_client != 0) ? 0 : 1;\n    else if (should_negotiate != NULL && strcmp(should_negotiate, "fail-server") == 0)\n        ret = (err_in_server != 0) ? 0 : 1;\n    return (ret);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']