ssl/ssl_lib.c:5531: error: USE_AFTER_FREE
  call to `sk_SSL_CIPHER_free()` eventually accesses memory that was invalidated by call to `free()` on line 5501 indirectly during the call to `sk_SSL_CIPHER_push()`.
Showing all 24 steps of the trace


ssl/ssl_lib.c:5478:10: invalidation part of the trace starts here
5476.       }
5477.   
5478.       sk = sk_SSL_CIPHER_new_null();
                 ^
5479.       scsvs = sk_SSL_CIPHER_new_null();
5480.       if (sk == NULL || scsvs == NULL) {

ssl/ssl_lib.c:5478:10: passed as argument to `sk_SSL_CIPHER_new_null`
  5476.       }
  5477.   
  5478.       sk = sk_SSL_CIPHER_new_null();
                   ^
  5479.       scsvs = sk_SSL_CIPHER_new_null();
  5480.       if (sk == NULL || scsvs == NULL) {

ssl/ssl_lib.c:5478:10: return from call to `sk_SSL_CIPHER_new_null`
  5476.       }
  5477.   
  5478.       sk = sk_SSL_CIPHER_new_null();
                   ^
  5479.       scsvs = sk_SSL_CIPHER_new_null();
  5480.       if (sk == NULL || scsvs == NULL) {

ssl/ssl_lib.c:5478:5: assigned
  5476.       }
  5477.   
  5478.       sk = sk_SSL_CIPHER_new_null();
              ^
  5479.       scsvs = sk_SSL_CIPHER_new_null();
  5480.       if (sk == NULL || scsvs == NULL) {

ssl/ssl_lib.c:5501:31: when calling `sk_SSL_CIPHER_push` here
  5499.           c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1);
  5500.           if (c != NULL) {
  5501.               if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) ||
                                        ^
  5502.                   (!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) {
  5503.                   if (fatal)

include/openssl/ssl.h:966:1: parameter `sk` of sk_SSL_CIPHER_push
    964.    * in VisualStudio 2015
    965.    */
    966. > DEFINE_STACK_OF_CONST(SSL_CIPHER)
    967.   DEFINE_STACK_OF(SSL_COMP)
    968.   

include/openssl/ssl.h:966:1: when calling `OPENSSL_sk_push` here
    964.    * in VisualStudio 2015
    965.    */
    966. > DEFINE_STACK_OF_CONST(SSL_CIPHER)
    967.   DEFINE_STACK_OF(SSL_COMP)
    968.   

crypto/stack/stack.c:325:1: parameter `st` of OPENSSL_sk_push
      323.   }
      324.   
      325. > int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)
      326.   {
      327.       if (st == NULL)

crypto/stack/stack.c:329:12: when calling `OPENSSL_sk_insert` here
      327.       if (st == NULL)
      328.           return -1;
      329.       return OPENSSL_sk_insert(st, data, st->num);
                        ^
      330.   }
      331.   

crypto/stack/stack.c:236:1: parameter `st` of OPENSSL_sk_insert
        234.   }
        235.   
        236. > int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)
        237.   {
        238.       if (st == NULL || st->num == max_nodes)

crypto/stack/stack.c:241:10: when calling `sk_reserve` here
        239.           return 0;
        240.   
        241.       if (!sk_reserve(st, 1, 0))
                        ^
        242.           return 0;
        243.   

crypto/stack/stack.c:159:1: parameter `st` of sk_reserve
          157.   
          158.   /* internal STACK storage allocation */
          159. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
          160.   {
          161.       const void **tmpdata;

crypto/stack/stack.c:197:15: when calling `CRYPTO_realloc` here
          195.       }
          196.   
          197.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                               ^
          198.       if (tmpdata == NULL)
          199.           return 0;

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
            236.   }
            237.   
            238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            239.   {
            240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
            247.   
            248.       if (num == 0) {
            249.           CRYPTO_free(str, file, line);
                           ^
            250.           return NULL;
            251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
              293.   }
              294.   
              295. > void CRYPTO_free(void *str, const char *file, int line)
              296.   {
              297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
              310.       }
              311.   #else
              312.       free(str);
                         ^
              313.   #endif
              314.   }

ssl/ssl_lib.c:5478:10: use-after-lifetime part of the trace starts here
5476.       }
5477.   
5478.       sk = sk_SSL_CIPHER_new_null();
                 ^
5479.       scsvs = sk_SSL_CIPHER_new_null();
5480.       if (sk == NULL || scsvs == NULL) {

ssl/ssl_lib.c:5478:10: passed as argument to `sk_SSL_CIPHER_new_null`
  5476.       }
  5477.   
  5478.       sk = sk_SSL_CIPHER_new_null();
                   ^
  5479.       scsvs = sk_SSL_CIPHER_new_null();
  5480.       if (sk == NULL || scsvs == NULL) {

ssl/ssl_lib.c:5478:10: return from call to `sk_SSL_CIPHER_new_null`
  5476.       }
  5477.   
  5478.       sk = sk_SSL_CIPHER_new_null();
                   ^
  5479.       scsvs = sk_SSL_CIPHER_new_null();
  5480.       if (sk == NULL || scsvs == NULL) {

ssl/ssl_lib.c:5478:5: assigned
  5476.       }
  5477.   
  5478.       sk = sk_SSL_CIPHER_new_null();
              ^
  5479.       scsvs = sk_SSL_CIPHER_new_null();
  5480.       if (sk == NULL || scsvs == NULL) {

ssl/ssl_lib.c:5531:5: when calling `sk_SSL_CIPHER_free` here
  5529.       return 1;
  5530.    err:
  5531.       sk_SSL_CIPHER_free(sk);
              ^
  5532.       sk_SSL_CIPHER_free(scsvs);
  5533.       return 0;

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
["int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites,\n                         STACK_OF(SSL_CIPHER) **skp,\n                         STACK_OF(SSL_CIPHER) **scsvs_out,\n                         int sslv2format, int fatal)\n{\n    const SSL_CIPHER *c;\n    STACK_OF(SSL_CIPHER) *sk = NULL;\n    STACK_OF(SSL_CIPHER) *scsvs = NULL;\n    int n;\n    unsigned char cipher[SSLV2_CIPHER_LEN];\n    n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;\n    if (PACKET_remaining(cipher_suites) == 0) {\n        if (fatal)\n            SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_BYTES_TO_CIPHER_LIST,\n                     SSL_R_NO_CIPHERS_SPECIFIED);\n        else\n            SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED);\n        return 0;\n    }\n    if (PACKET_remaining(cipher_suites) % n != 0) {\n        if (fatal)\n            SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,\n                     SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);\n        else\n            SSLerr(SSL_F_BYTES_TO_CIPHER_LIST,\n                   SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);\n        return 0;\n    }\n    sk = sk_SSL_CIPHER_new_null();\n    scsvs = sk_SSL_CIPHER_new_null();\n    if (sk == NULL || scsvs == NULL) {\n        if (fatal)\n            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,\n                     ERR_R_MALLOC_FAILURE);\n        else\n            SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    while (PACKET_copy_bytes(cipher_suites, cipher, n)) {\n        if (sslv2format && cipher[0] != '\\0')\n            continue;\n        c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1);\n        if (c != NULL) {\n            if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) ||\n                (!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) {\n                if (fatal)\n                    SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                             SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n                else\n                    SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n        }\n    }\n    if (PACKET_remaining(cipher_suites) > 0) {\n        if (fatal)\n            SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,\n                     SSL_R_BAD_LENGTH);\n        else\n            SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_BAD_LENGTH);\n        goto err;\n    }\n    if (skp != NULL)\n        *skp = sk;\n    else\n        sk_SSL_CIPHER_free(sk);\n    if (scsvs_out != NULL)\n        *scsvs_out = scsvs;\n    else\n        sk_SSL_CIPHER_free(scsvs);\n    return 1;\n err:\n    sk_SSL_CIPHER_free(sk);\n    sk_SSL_CIPHER_free(scsvs);\n    return 0;\n}", 'int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)\n{\n    if (st == NULL)\n        return -1;\n    return OPENSSL_sk_insert(st, data, st->num);\n}', 'int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)\n{\n    if (st == NULL || st->num == max_nodes)\n        return 0;\n    if (!sk_reserve(st, 1, 0))\n        return 0;\n    if ((loc >= st->num) || (loc < 0)) {\n        st->data[st->num] = data;\n    } else {\n        memmove(&st->data[loc + 1], &st->data[loc],\n                sizeof(st->data[0]) * (st->num - loc));\n        st->data[loc] = data;\n    }\n    st->num++;\n    st->sorted = 0;\n    return st->num;\n}', 'static int sk_reserve(OPENSSL_STACK *st, int n, int exact)\n{\n    const void **tmpdata;\n    int num_alloc;\n    if (n > max_nodes - st->num)\n        return 0;\n    num_alloc = st->num + n;\n    if (num_alloc < min_nodes)\n        num_alloc = min_nodes;\n    if (st->data == NULL) {\n        if ((st->data = OPENSSL_zalloc(sizeof(void *) * num_alloc)) == NULL) {\n            CRYPTOerr(CRYPTO_F_SK_RESERVE, ERR_R_MALLOC_FAILURE);\n            return 0;\n        }\n        st->num_alloc = num_alloc;\n        return 1;\n    }\n    if (!exact) {\n        if (num_alloc <= st->num_alloc)\n            return 1;\n        num_alloc = compute_growth(num_alloc, st->num_alloc);\n        if (num_alloc == 0)\n            return 0;\n    } else if (num_alloc == st->num_alloc) {\n        return 1;\n    }\n    tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);\n    if (tmpdata == NULL)\n        return 0;\n    st->data = tmpdata;\n    st->num_alloc = num_alloc;\n    return 1;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    INCREMENT(realloc_count);\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']