ssl/bio_ssl.c:290: error: USE_AFTER_FREE
  accessing memory that was invalidated by call to `free()` on line 284 indirectly during the call to `ssl_free()`.
Showing all 16 steps of the trace


ssl/bio_ssl.c:224:1: invalidation part of the trace starts here
222.   }
223.   
224. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
225.   {
226.       SSL **sslp, *ssl;

ssl/bio_ssl.c:224:1: parameter `b` of ssl_ctrl
  222.   }
  223.   
  224. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
  225.   {
  226.       SSL **sslp, *ssl;

ssl/bio_ssl.c:284:13: when calling `ssl_free` here
  282.       case BIO_C_SET_SSL:
  283.           if (ssl != NULL) {
  284.               ssl_free(b);
                     ^
  285.               if (!ssl_new(b))
  286.                   return 0;

ssl/bio_ssl.c:72:1: parameter `a` of ssl_free
    70.   }
    71.   
    72. > static int ssl_free(BIO *a)
    73.   {
    74.       BIO_SSL *bs;

ssl/bio_ssl.c:78:10: passed as argument to `BIO_get_data`
    76.       if (a == NULL)
    77.           return 0;
    78.       bs = BIO_get_data(a);
                   ^
    79.       if (bs->ssl != NULL)
    80.           SSL_shutdown(bs->ssl);

ssl/bio_ssl.c:78:10: return from call to `BIO_get_data`
    76.       if (a == NULL)
    77.           return 0;
    78.       bs = BIO_get_data(a);
                   ^
    79.       if (bs->ssl != NULL)
    80.           SSL_shutdown(bs->ssl);

ssl/bio_ssl.c:78:5: assigned
    76.       if (a == NULL)
    77.           return 0;
    78.       bs = BIO_get_data(a);
              ^
    79.       if (bs->ssl != NULL)
    80.           SSL_shutdown(bs->ssl);

ssl/bio_ssl.c:88:5: when calling `CRYPTO_free` here
    86.           BIO_set_init(a, 0);
    87.       }
    88.       OPENSSL_free(bs);
              ^
    89.       return 1;
    90.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
      310.       }
      311.   #else
      312.       free(str);
                 ^
      313.   #endif
      314.   }

ssl/bio_ssl.c:224:1: use-after-lifetime part of the trace starts here
222.   }
223.   
224. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
225.   {
226.       SSL **sslp, *ssl;

ssl/bio_ssl.c:224:1: parameter `b` of ssl_ctrl
  222.   }
  223.   
  224. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
  225.   {
  226.       SSL **sslp, *ssl;

ssl/bio_ssl.c:232:10: passed as argument to `BIO_get_data`
  230.       BIO *next;
  231.   
  232.       bs = BIO_get_data(b);
                  ^
  233.       next = BIO_next(b);
  234.       ssl = bs->ssl;

ssl/bio_ssl.c:232:10: return from call to `BIO_get_data`
  230.       BIO *next;
  231.   
  232.       bs = BIO_get_data(b);
                  ^
  233.       next = BIO_next(b);
  234.       ssl = bs->ssl;

ssl/bio_ssl.c:232:5: assigned
  230.       BIO *next;
  231.   
  232.       bs = BIO_get_data(b);
             ^
  233.       next = BIO_next(b);
  234.       ssl = bs->ssl;

ssl/bio_ssl.c:290:9: invalid access occurs here
  288.           BIO_set_shutdown(b, num);
  289.           ssl = (SSL *)ptr;
  290.           bs->ssl = ssl;
                 ^
  291.           bio = SSL_get_rbio(ssl);
  292.           if (bio != NULL) {

static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
{
    SSL **sslp, *ssl;
    BIO_SSL *bs, *dbs;
    BIO *dbio, *bio;
    long ret = 1;
    BIO *next;
    bs = BIO_get_data(b);
    next = BIO_next(b);
    ssl = bs->ssl;
    if ((ssl == NULL) && (cmd != BIO_C_SET_SSL))
        return 0;
    switch (cmd) {
    case BIO_CTRL_RESET:
        SSL_shutdown(ssl);
        if (ssl->handshake_func == ssl->method->ssl_connect)
            SSL_set_connect_state(ssl);
        else if (ssl->handshake_func == ssl->method->ssl_accept)
            SSL_set_accept_state(ssl);
        if (!SSL_clear(ssl)) {
            ret = 0;
            break;
        }
        if (next != NULL)
            ret = BIO_ctrl(next, cmd, num, ptr);
        else if (ssl->rbio != NULL)
            ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
        else
            ret = 1;
        break;
    case BIO_CTRL_INFO:
        ret = 0;
        break;
    case BIO_C_SSL_MODE:
        if (num)
            SSL_set_connect_state(ssl);
        else
            SSL_set_accept_state(ssl);
        break;
    case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:
        ret = bs->renegotiate_timeout;
        if (num < 60)
            num = 5;
        bs->renegotiate_timeout = (unsigned long)num;
        bs->last_time = (unsigned long)time(NULL);
        break;
    case BIO_C_SET_SSL_RENEGOTIATE_BYTES:
        ret = bs->renegotiate_count;
        if ((long)num >= 512)
            bs->renegotiate_count = (unsigned long)num;
        break;
    case BIO_C_GET_SSL_NUM_RENEGOTIATES:
        ret = bs->num_renegotiates;
        break;
    case BIO_C_SET_SSL:
        if (ssl != NULL) {
            ssl_free(b);
            if (!ssl_new(b))
                return 0;
        }
        BIO_set_shutdown(b, num);
        ssl = (SSL *)ptr;
        bs->ssl = ssl;
        bio = SSL_get_rbio(ssl);
        if (bio != NULL) {
            if (next != NULL)
                BIO_push(bio, next);
            BIO_set_next(b, bio);
            BIO_up_ref(bio);
        }
        BIO_set_init(b, 1);
        break;
    case BIO_C_GET_SSL:
        if (ptr != NULL) {
            sslp = (SSL **)ptr;
            *sslp = ssl;
        } else
            ret = 0;
        break;
    case BIO_CTRL_GET_CLOSE:
        ret = BIO_get_shutdown(b);
        break;
    case BIO_CTRL_SET_CLOSE:
        BIO_set_shutdown(b, (int)num);
        break;
    case BIO_CTRL_WPENDING:
        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);
        break;
    case BIO_CTRL_PENDING:
        ret = SSL_pending(ssl);
        if (ret == 0)
            ret = BIO_pending(ssl->rbio);
        break;
    case BIO_CTRL_FLUSH:
        BIO_clear_retry_flags(b);
        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);
        BIO_copy_next_retry(b);
        break;
    case BIO_CTRL_PUSH:
        if ((next != NULL) && (next != ssl->rbio)) {
            BIO_up_ref(next);
            SSL_set_bio(ssl, next, next);
        }
        break;
    case BIO_CTRL_POP:
        if (b == ptr) {
            SSL_set_bio(ssl, NULL, NULL);
        }
        break;
    case BIO_C_DO_STATE_MACHINE:
        BIO_clear_retry_flags(b);
        BIO_set_retry_reason(b, 0);
        ret = (int)SSL_do_handshake(ssl);
        switch (SSL_get_error(ssl, (int)ret)) {
        case SSL_ERROR_WANT_READ:
            BIO_set_flags(b, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
            break;
        case SSL_ERROR_WANT_WRITE:
            BIO_set_flags(b, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);
            break;
        case SSL_ERROR_WANT_CONNECT:
            BIO_set_flags(b, BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY);
            BIO_set_retry_reason(b, BIO_get_retry_reason(next));
            break;
        case SSL_ERROR_WANT_X509_LOOKUP:
            BIO_set_retry_special(b);
            BIO_set_retry_reason(b, BIO_RR_SSL_X509_LOOKUP);
            break;
        default:
            break;
        }
        break;
    case BIO_CTRL_DUP:
        dbio = (BIO *)ptr;
        dbs = BIO_get_data(dbio);
        SSL_free(dbs->ssl);
        dbs->ssl = SSL_dup(ssl);
        dbs->num_renegotiates = bs->num_renegotiates;
        dbs->renegotiate_count = bs->renegotiate_count;
        dbs->byte_count = bs->byte_count;
        dbs->renegotiate_timeout = bs->renegotiate_timeout;
        dbs->last_time = bs->last_time;
        ret = (dbs->ssl != NULL);
        break;
    case BIO_C_GET_FD:
        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
        break;
    case BIO_CTRL_SET_CALLBACK:
        ret = 0;
        break;
    default:
        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
        break;
    }
    return ret;
}
['static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)\n{\n    SSL **sslp, *ssl;\n    BIO_SSL *bs, *dbs;\n    BIO *dbio, *bio;\n    long ret = 1;\n    BIO *next;\n    bs = BIO_get_data(b);\n    next = BIO_next(b);\n    ssl = bs->ssl;\n    if ((ssl == NULL) && (cmd != BIO_C_SET_SSL))\n        return 0;\n    switch (cmd) {\n    case BIO_CTRL_RESET:\n        SSL_shutdown(ssl);\n        if (ssl->handshake_func == ssl->method->ssl_connect)\n            SSL_set_connect_state(ssl);\n        else if (ssl->handshake_func == ssl->method->ssl_accept)\n            SSL_set_accept_state(ssl);\n        if (!SSL_clear(ssl)) {\n            ret = 0;\n            break;\n        }\n        if (next != NULL)\n            ret = BIO_ctrl(next, cmd, num, ptr);\n        else if (ssl->rbio != NULL)\n            ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);\n        else\n            ret = 1;\n        break;\n    case BIO_CTRL_INFO:\n        ret = 0;\n        break;\n    case BIO_C_SSL_MODE:\n        if (num)\n            SSL_set_connect_state(ssl);\n        else\n            SSL_set_accept_state(ssl);\n        break;\n    case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:\n        ret = bs->renegotiate_timeout;\n        if (num < 60)\n            num = 5;\n        bs->renegotiate_timeout = (unsigned long)num;\n        bs->last_time = (unsigned long)time(NULL);\n        break;\n    case BIO_C_SET_SSL_RENEGOTIATE_BYTES:\n        ret = bs->renegotiate_count;\n        if ((long)num >= 512)\n            bs->renegotiate_count = (unsigned long)num;\n        break;\n    case BIO_C_GET_SSL_NUM_RENEGOTIATES:\n        ret = bs->num_renegotiates;\n        break;\n    case BIO_C_SET_SSL:\n        if (ssl != NULL) {\n            ssl_free(b);\n            if (!ssl_new(b))\n                return 0;\n        }\n        BIO_set_shutdown(b, num);\n        ssl = (SSL *)ptr;\n        bs->ssl = ssl;\n        bio = SSL_get_rbio(ssl);\n        if (bio != NULL) {\n            if (next != NULL)\n                BIO_push(bio, next);\n            BIO_set_next(b, bio);\n            BIO_up_ref(bio);\n        }\n        BIO_set_init(b, 1);\n        break;\n    case BIO_C_GET_SSL:\n        if (ptr != NULL) {\n            sslp = (SSL **)ptr;\n            *sslp = ssl;\n        } else\n            ret = 0;\n        break;\n    case BIO_CTRL_GET_CLOSE:\n        ret = BIO_get_shutdown(b);\n        break;\n    case BIO_CTRL_SET_CLOSE:\n        BIO_set_shutdown(b, (int)num);\n        break;\n    case BIO_CTRL_WPENDING:\n        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);\n        break;\n    case BIO_CTRL_PENDING:\n        ret = SSL_pending(ssl);\n        if (ret == 0)\n            ret = BIO_pending(ssl->rbio);\n        break;\n    case BIO_CTRL_FLUSH:\n        BIO_clear_retry_flags(b);\n        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);\n        BIO_copy_next_retry(b);\n        break;\n    case BIO_CTRL_PUSH:\n        if ((next != NULL) && (next != ssl->rbio)) {\n            BIO_up_ref(next);\n            SSL_set_bio(ssl, next, next);\n        }\n        break;\n    case BIO_CTRL_POP:\n        if (b == ptr) {\n            SSL_set_bio(ssl, NULL, NULL);\n        }\n        break;\n    case BIO_C_DO_STATE_MACHINE:\n        BIO_clear_retry_flags(b);\n        BIO_set_retry_reason(b, 0);\n        ret = (int)SSL_do_handshake(ssl);\n        switch (SSL_get_error(ssl, (int)ret)) {\n        case SSL_ERROR_WANT_READ:\n            BIO_set_flags(b, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);\n            break;\n        case SSL_ERROR_WANT_WRITE:\n            BIO_set_flags(b, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);\n            break;\n        case SSL_ERROR_WANT_CONNECT:\n            BIO_set_flags(b, BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY);\n            BIO_set_retry_reason(b, BIO_get_retry_reason(next));\n            break;\n        case SSL_ERROR_WANT_X509_LOOKUP:\n            BIO_set_retry_special(b);\n            BIO_set_retry_reason(b, BIO_RR_SSL_X509_LOOKUP);\n            break;\n        default:\n            break;\n        }\n        break;\n    case BIO_CTRL_DUP:\n        dbio = (BIO *)ptr;\n        dbs = BIO_get_data(dbio);\n        SSL_free(dbs->ssl);\n        dbs->ssl = SSL_dup(ssl);\n        dbs->num_renegotiates = bs->num_renegotiates;\n        dbs->renegotiate_count = bs->renegotiate_count;\n        dbs->byte_count = bs->byte_count;\n        dbs->renegotiate_timeout = bs->renegotiate_timeout;\n        dbs->last_time = bs->last_time;\n        ret = (dbs->ssl != NULL);\n        break;\n    case BIO_C_GET_FD:\n        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);\n        break;\n    case BIO_CTRL_SET_CALLBACK:\n        ret = 0;\n        break;\n    default:\n        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);\n        break;\n    }\n    return ret;\n}', 'static int ssl_free(BIO *a)\n{\n    BIO_SSL *bs;\n    if (a == NULL)\n        return 0;\n    bs = BIO_get_data(a);\n    if (bs->ssl != NULL)\n        SSL_shutdown(bs->ssl);\n    if (BIO_get_shutdown(a)) {\n        if (BIO_get_init(a))\n            SSL_free(bs->ssl);\n        BIO_clear_flags(a, ~0);\n        BIO_set_init(a, 0);\n    }\n    OPENSSL_free(bs);\n    return 1;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}']