crypto/asn1/tasn_dec.c:889: error: USE_AFTER_FREE
  call to `ASN1_STRING_free()` eventually accesses memory that was invalidated by call to `free()` on line 887 indirectly during the call to `ASN1_STRING_set()`.
Showing all 22 steps of the trace


crypto/asn1/tasn_dec.c:774:1: invalidation part of the trace starts here
772.   /* Translate ASN1 content octets into a structure */
773.   
774. > static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
775.                          int utype, char *free_cont, const ASN1_ITEM *it)
776.   {

crypto/asn1/tasn_dec.c:774:1: parameter `pval` of asn1_ex_c2i
  772.   /* Translate ASN1 content octets into a structure */
  773.   
  774. > static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
  775.                          int utype, char *free_cont, const ASN1_ITEM *it)
  776.   {

crypto/asn1/tasn_dec.c:877:13: assigned
  875.               *pval = (ASN1_VALUE *)stmp;
  876.           } else {
  877.               stmp = (ASN1_STRING *)*pval;
                     ^
  878.               stmp->type = utype;
  879.           }

crypto/asn1/tasn_dec.c:887:18: when calling `ASN1_STRING_set` here
  885.               *free_cont = 0;
  886.           } else {
  887.               if (!ASN1_STRING_set(stmp, cont, len)) {
                          ^
  888.                   ASN1err(ASN1_F_ASN1_EX_C2I, ERR_R_MALLOC_FAILURE);
  889.                   ASN1_STRING_free(stmp);

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
    269.   }
    270.   
    271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
    272.   {
    273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
    281.       }
    282.       if ((str->length <= len) || (str->data == NULL)) {
    283.           c = str->data;
                   ^
    284.           str->data = OPENSSL_realloc(c, len + 1);
    285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:284:21: when calling `CRYPTO_realloc` here
    282.       if ((str->length <= len) || (str->data == NULL)) {
    283.           c = str->data;
    284.           str->data = OPENSSL_realloc(c, len + 1);
                               ^
    285.           if (str->data == NULL) {
    286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
      236.   }
      237.   
      238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      239.   {
      240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
      247.   
      248.       if (num == 0) {
      249.           CRYPTO_free(str, file, line);
                     ^
      250.           return NULL;
      251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
        293.   }
        294.   
        295. > void CRYPTO_free(void *str, const char *file, int line)
        296.   {
        297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
        310.       }
        311.   #else
        312.       free(str);
                   ^
        313.   #endif
        314.   }

crypto/asn1/tasn_dec.c:774:1: use-after-lifetime part of the trace starts here
772.   /* Translate ASN1 content octets into a structure */
773.   
774. > static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
775.                          int utype, char *free_cont, const ASN1_ITEM *it)
776.   {

crypto/asn1/tasn_dec.c:774:1: parameter `pval` of asn1_ex_c2i
  772.   /* Translate ASN1 content octets into a structure */
  773.   
  774. > static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
  775.                          int utype, char *free_cont, const ASN1_ITEM *it)
  776.   {

crypto/asn1/tasn_dec.c:877:13: assigned
  875.               *pval = (ASN1_VALUE *)stmp;
  876.           } else {
  877.               stmp = (ASN1_STRING *)*pval;
                     ^
  878.               stmp->type = utype;
  879.           }

crypto/asn1/tasn_dec.c:887:18: passed as argument to `ASN1_STRING_set`
  885.               *free_cont = 0;
  886.           } else {
  887.               if (!ASN1_STRING_set(stmp, cont, len)) {
                          ^
  888.                   ASN1err(ASN1_F_ASN1_EX_C2I, ERR_R_MALLOC_FAILURE);
  889.                   ASN1_STRING_free(stmp);

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
    269.   }
    270.   
    271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
    272.   {
    273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
    281.       }
    282.       if ((str->length <= len) || (str->data == NULL)) {
    283.           c = str->data;
                   ^
    284.           str->data = OPENSSL_realloc(c, len + 1);
    285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:287:13: assigned
    285.           if (str->data == NULL) {
    286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
    287.               str->data = c;
                       ^
    288.               return 0;
    289.           }

crypto/asn1/tasn_dec.c:887:18: return from call to `ASN1_STRING_set`
  885.               *free_cont = 0;
  886.           } else {
  887.               if (!ASN1_STRING_set(stmp, cont, len)) {
                          ^
  888.                   ASN1err(ASN1_F_ASN1_EX_C2I, ERR_R_MALLOC_FAILURE);
  889.                   ASN1_STRING_free(stmp);

crypto/asn1/tasn_dec.c:889:17: when calling `ASN1_STRING_free` here
  887.               if (!ASN1_STRING_set(stmp, cont, len)) {
  888.                   ASN1err(ASN1_F_ASN1_EX_C2I, ERR_R_MALLOC_FAILURE);
  889.                   ASN1_STRING_free(stmp);
                         ^
  890.                   *pval = NULL;
  891.                   goto err;

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }

void CRYPTO_free(void *str, const char *file, int line)
{
    INCREMENT(free_count);
    if (free_impl != NULL && free_impl != &CRYPTO_free) {
        free_impl(str, file, line);
        return;
    }
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_free(str, 0, file, line);
        free(str);
        CRYPTO_mem_debug_free(str, 1, file, line);
    } else {
        free(str);
    }
#else
    free(str);
#endif
}
['static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,\n                       int utype, char *free_cont, const ASN1_ITEM *it)\n{\n    ASN1_VALUE **opval = NULL;\n    ASN1_STRING *stmp;\n    ASN1_TYPE *typ = NULL;\n    int ret = 0;\n    const ASN1_PRIMITIVE_FUNCS *pf;\n    ASN1_INTEGER **tint;\n    pf = it->funcs;\n    if (pf && pf->prim_c2i)\n        return pf->prim_c2i(pval, cont, len, utype, free_cont, it);\n    if (it->utype == V_ASN1_ANY) {\n        if (!*pval) {\n            typ = ASN1_TYPE_new();\n            if (typ == NULL)\n                goto err;\n            *pval = (ASN1_VALUE *)typ;\n        } else\n            typ = (ASN1_TYPE *)*pval;\n        if (utype != typ->type)\n            ASN1_TYPE_set(typ, utype, NULL);\n        opval = pval;\n        pval = &typ->value.asn1_value;\n    }\n    switch (utype) {\n    case V_ASN1_OBJECT:\n        if (!c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len))\n            goto err;\n        break;\n    case V_ASN1_NULL:\n        if (len) {\n            ASN1err(ASN1_F_ASN1_EX_C2I, ASN1_R_NULL_IS_WRONG_LENGTH);\n            goto err;\n        }\n        *pval = (ASN1_VALUE *)1;\n        break;\n    case V_ASN1_BOOLEAN:\n        if (len != 1) {\n            ASN1err(ASN1_F_ASN1_EX_C2I, ASN1_R_BOOLEAN_IS_WRONG_LENGTH);\n            goto err;\n        } else {\n            ASN1_BOOLEAN *tbool;\n            tbool = (ASN1_BOOLEAN *)pval;\n            *tbool = *cont;\n        }\n        break;\n    case V_ASN1_BIT_STRING:\n        if (!c2i_ASN1_BIT_STRING((ASN1_BIT_STRING **)pval, &cont, len))\n            goto err;\n        break;\n    case V_ASN1_INTEGER:\n    case V_ASN1_ENUMERATED:\n        tint = (ASN1_INTEGER **)pval;\n        if (!c2i_ASN1_INTEGER(tint, &cont, len))\n            goto err;\n        (*tint)->type = utype | ((*tint)->type & V_ASN1_NEG);\n        break;\n    case V_ASN1_OCTET_STRING:\n    case V_ASN1_NUMERICSTRING:\n    case V_ASN1_PRINTABLESTRING:\n    case V_ASN1_T61STRING:\n    case V_ASN1_VIDEOTEXSTRING:\n    case V_ASN1_IA5STRING:\n    case V_ASN1_UTCTIME:\n    case V_ASN1_GENERALIZEDTIME:\n    case V_ASN1_GRAPHICSTRING:\n    case V_ASN1_VISIBLESTRING:\n    case V_ASN1_GENERALSTRING:\n    case V_ASN1_UNIVERSALSTRING:\n    case V_ASN1_BMPSTRING:\n    case V_ASN1_UTF8STRING:\n    case V_ASN1_OTHER:\n    case V_ASN1_SET:\n    case V_ASN1_SEQUENCE:\n    default:\n        if (utype == V_ASN1_BMPSTRING && (len & 1)) {\n            ASN1err(ASN1_F_ASN1_EX_C2I, ASN1_R_BMPSTRING_IS_WRONG_LENGTH);\n            goto err;\n        }\n        if (utype == V_ASN1_UNIVERSALSTRING && (len & 3)) {\n            ASN1err(ASN1_F_ASN1_EX_C2I,\n                    ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH);\n            goto err;\n        }\n        if (!*pval) {\n            stmp = ASN1_STRING_type_new(utype);\n            if (stmp == NULL) {\n                ASN1err(ASN1_F_ASN1_EX_C2I, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            *pval = (ASN1_VALUE *)stmp;\n        } else {\n            stmp = (ASN1_STRING *)*pval;\n            stmp->type = utype;\n        }\n        if (*free_cont) {\n            OPENSSL_free(stmp->data);\n            stmp->data = (unsigned char *)cont;\n            stmp->length = len;\n            *free_cont = 0;\n        } else {\n            if (!ASN1_STRING_set(stmp, cont, len)) {\n                ASN1err(ASN1_F_ASN1_EX_C2I, ERR_R_MALLOC_FAILURE);\n                ASN1_STRING_free(stmp);\n                *pval = NULL;\n                goto err;\n            }\n        }\n        break;\n    }\n    if (typ && (utype == V_ASN1_NULL))\n        typ->value.ptr = NULL;\n    ret = 1;\n err:\n    if (!ret) {\n        ASN1_TYPE_free(typ);\n        if (opval)\n            *opval = NULL;\n    }\n    return ret;\n}', "int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)\n{\n    unsigned char *c;\n    const char *data = _data;\n    if (len < 0) {\n        if (data == NULL)\n            return 0;\n        else\n            len = strlen(data);\n    }\n    if ((str->length <= len) || (str->data == NULL)) {\n        c = str->data;\n        str->data = OPENSSL_realloc(c, len + 1);\n        if (str->data == NULL) {\n            ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);\n            str->data = c;\n            return 0;\n        }\n    }\n    str->length = len;\n    if (data != NULL) {\n        memcpy(str->data, data, len);\n        str->data[len] = '\\0';\n    }\n    return 1;\n}", 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    INCREMENT(realloc_count);\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)(file); (void)(line);\n#endif\n    return realloc(str, num);\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']