crypto/conf/conf_mod.c:388: error: USE_AFTER_FREE
  call to `module_finish()` eventually accesses memory that was invalidated by call to `free()` on line 388 indirectly during the call to `module_finish()`.
Showing all 40 steps of the trace


crypto/conf/conf_mod.c:386:32: invalidation part of the trace starts here
384.   {
385.       CONF_IMODULE *imod;
386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
                                      ^
387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
388.           module_finish(imod);

crypto/conf/conf_mod.c:386:32: global variable `initialized_modules` accessed here
  384.   {
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
                                        ^
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
  388.           module_finish(imod);

crypto/conf/conf_mod.c:387:16: passed as argument to `sk_CONF_IMODULE_pop`
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  388.           module_finish(imod);
  389.       }

include/openssl/conf.h:57:1: parameter `sk` of sk_CONF_IMODULE_pop
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

include/openssl/conf.h:57:1: passed as argument to `OPENSSL_sk_pop`
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

crypto/stack/stack.c:231:1: parameter `st` of OPENSSL_sk_pop
      229.   }
      230.   
      231. > void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      232.   {
      233.       if (st == NULL)

crypto/stack/stack.c:237:13: passed as argument to `OPENSSL_sk_delete`
      235.       if (st->num <= 0)
      236.           return (NULL);
      237.       return (OPENSSL_sk_delete(st, st->num - 1));
                         ^
      238.   }
      239.   

crypto/stack/stack.c:155:1: parameter `st` of OPENSSL_sk_delete
        153.   }
        154.   
        155. > void *OPENSSL_sk_delete(OPENSSL_STACK *st, int loc)
        156.   {
        157.       char *ret;

crypto/stack/stack.c:167:13: assigned
        165.           j = st->num - 1;
        166.           for (i = loc; i < j; i++)
        167.               st->data[i] = st->data[i + 1];
                           ^
        168.           /*
        169.            * In theory memcpy is not safe for this memcpy( &(st->data[loc]),

crypto/stack/stack.c:237:13: return from call to `OPENSSL_sk_delete`
      235.       if (st->num <= 0)
      236.           return (NULL);
      237.       return (OPENSSL_sk_delete(st, st->num - 1));
                         ^
      238.   }
      239.   

include/openssl/conf.h:57:1: return from call to `OPENSSL_sk_pop`
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

crypto/conf/conf_mod.c:387:16: return from call to `sk_CONF_IMODULE_pop`
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  388.           module_finish(imod);
  389.       }

crypto/conf/conf_mod.c:387:16: passed as argument to `sk_CONF_IMODULE_pop`
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  388.           module_finish(imod);
  389.       }

crypto/conf/conf_mod.c:387:16: return from call to `sk_CONF_IMODULE_pop`
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  388.           module_finish(imod);
  389.       }

crypto/conf/conf_mod.c:387:9: assigned
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                 ^
  388.           module_finish(imod);
  389.       }

crypto/conf/conf_mod.c:388:9: when calling `module_finish` here
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
  388.           module_finish(imod);
                 ^
  389.       }
  390.       sk_CONF_IMODULE_free(initialized_modules);

crypto/conf/conf_mod.c:396:1: parameter `imod` of module_finish
    394.   /* finish a module instance */
    395.   
    396. > static void module_finish(CONF_IMODULE *imod)
    397.   {
    398.       if (!imod)

crypto/conf/conf_mod.c:405:5: when calling `CRYPTO_free` here
    403.       OPENSSL_free(imod->name);
    404.       OPENSSL_free(imod->value);
    405.       OPENSSL_free(imod);
               ^
    406.   }
    407.   

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
      161.   }
      162.   
      163. > void CRYPTO_free(void *str, const char *file, int line)
      164.   {
      165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
      177.       }
      178.   #else
      179.       free(str);
                 ^
      180.   #endif
      181.   }

crypto/conf/conf_mod.c:386:32: use-after-lifetime part of the trace starts here
384.   {
385.       CONF_IMODULE *imod;
386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
                                      ^
387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
388.           module_finish(imod);

crypto/conf/conf_mod.c:386:32: global variable `initialized_modules` accessed here
  384.   {
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
                                        ^
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
  388.           module_finish(imod);

crypto/conf/conf_mod.c:387:16: passed as argument to `sk_CONF_IMODULE_pop`
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  388.           module_finish(imod);
  389.       }

include/openssl/conf.h:57:1: parameter `sk` of sk_CONF_IMODULE_pop
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

include/openssl/conf.h:57:1: passed as argument to `OPENSSL_sk_pop`
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

crypto/stack/stack.c:231:1: parameter `st` of OPENSSL_sk_pop
      229.   }
      230.   
      231. > void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      232.   {
      233.       if (st == NULL)

crypto/stack/stack.c:237:13: passed as argument to `OPENSSL_sk_delete`
      235.       if (st->num <= 0)
      236.           return (NULL);
      237.       return (OPENSSL_sk_delete(st, st->num - 1));
                         ^
      238.   }
      239.   

crypto/stack/stack.c:155:1: parameter `st` of OPENSSL_sk_delete
        153.   }
        154.   
        155. > void *OPENSSL_sk_delete(OPENSSL_STACK *st, int loc)
        156.   {
        157.       char *ret;

crypto/stack/stack.c:167:13: assigned
        165.           j = st->num - 1;
        166.           for (i = loc; i < j; i++)
        167.               st->data[i] = st->data[i + 1];
                           ^
        168.           /*
        169.            * In theory memcpy is not safe for this memcpy( &(st->data[loc]),

crypto/stack/stack.c:237:13: return from call to `OPENSSL_sk_delete`
      235.       if (st->num <= 0)
      236.           return (NULL);
      237.       return (OPENSSL_sk_delete(st, st->num - 1));
                         ^
      238.   }
      239.   

include/openssl/conf.h:57:1: return from call to `OPENSSL_sk_pop`
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

crypto/conf/conf_mod.c:387:16: return from call to `sk_CONF_IMODULE_pop`
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  388.           module_finish(imod);
  389.       }

crypto/conf/conf_mod.c:387:16: passed as argument to `sk_CONF_IMODULE_pop`
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  388.           module_finish(imod);
  389.       }

crypto/conf/conf_mod.c:387:16: return from call to `sk_CONF_IMODULE_pop`
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  388.           module_finish(imod);
  389.       }

crypto/conf/conf_mod.c:387:9: assigned
  385.       CONF_IMODULE *imod;
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                 ^
  388.           module_finish(imod);
  389.       }

crypto/conf/conf_mod.c:388:9: when calling `module_finish` here
  386.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  387.           imod = sk_CONF_IMODULE_pop(initialized_modules);
  388.           module_finish(imod);
                 ^
  389.       }
  390.       sk_CONF_IMODULE_free(initialized_modules);

crypto/conf/conf_mod.c:396:1: parameter `imod` of module_finish
    394.   /* finish a module instance */
    395.   
    396. > static void module_finish(CONF_IMODULE *imod)
    397.   {
    398.       if (!imod)

crypto/conf/conf_mod.c:405:5: when calling `CRYPTO_free` here
    403.       OPENSSL_free(imod->name);
    404.       OPENSSL_free(imod->value);
    405.       OPENSSL_free(imod);
               ^
    406.   }
    407.   

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
      161.   }
      162.   
      163. > void CRYPTO_free(void *str, const char *file, int line)
      164.   {
      165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: invalid access occurs here
      177.       }
      178.   #else
      179.       free(str);
                 ^
      180.   #endif
      181.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['void CONF_modules_finish(void)\n{\n    CONF_IMODULE *imod;\n    while (sk_CONF_IMODULE_num(initialized_modules) > 0) {\n        imod = sk_CONF_IMODULE_pop(initialized_modules);\n        module_finish(imod);\n    }\n    sk_CONF_IMODULE_free(initialized_modules);\n    initialized_modules = NULL;\n}', 'void *OPENSSL_sk_pop(OPENSSL_STACK *st)\n{\n    if (st == NULL)\n        return (NULL);\n    if (st->num <= 0)\n        return (NULL);\n    return (OPENSSL_sk_delete(st, st->num - 1));\n}', 'void *OPENSSL_sk_delete(OPENSSL_STACK *st, int loc)\n{\n    char *ret;\n    int i, j;\n    if (st == NULL || loc < 0 || loc >= st->num)\n        return NULL;\n    ret = st->data[loc];\n    if (loc != st->num - 1) {\n        j = st->num - 1;\n        for (i = loc; i < j; i++)\n            st->data[i] = st->data[i + 1];\n    }\n    st->num--;\n    return (ret);\n}', 'static void module_finish(CONF_IMODULE *imod)\n{\n    if (!imod)\n        return;\n    if (imod->pmod->finish)\n        imod->pmod->finish(imod);\n    imod->pmod->links--;\n    OPENSSL_free(imod->name);\n    OPENSSL_free(imod->value);\n    OPENSSL_free(imod);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']