crypto/x509v3/v3_pci.c:152: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 138 indirectly during the call to `CRYPTO_realloc()`.
Showing all 12 steps of the trace


crypto/x509v3/v3_pci.c:85:1: invalidation part of the trace starts here
83.   }
84.   
85. > static int process_pci_value(CONF_VALUE *val,
86.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
87.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:85:1: parameter `policy` of process_pci_value
  83.   }
  84.   
  85. > static int process_pci_value(CONF_VALUE *val,
  86.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  87.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:138:24: when calling `CRYPTO_realloc` here
  136.               }
  137.   
  138.               tmp_data = OPENSSL_realloc((*policy)->data,
                                ^
  139.                                          (*policy)->length + val_len + 1);
  140.               if (tmp_data) {

crypto/mem.c:196:1: parameter `str` of CRYPTO_realloc
    194.   }
    195.   
    196. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    197.   {
    198.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:206:9: when calling `CRYPTO_free` here
    204.   
    205.       if (num == 0) {
    206.           CRYPTO_free(str, file, line);
                   ^
    207.           return NULL;
    208.       }

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
      251.   }
      252.   
      253. > void CRYPTO_free(void *str, const char *file, int line)
      254.   {
      255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: was invalidated by call to `free()`
      267.       }
      268.   #else
      269.       free(str);
                 ^
      270.   #endif
      271.   }

crypto/x509v3/v3_pci.c:85:1: use-after-lifetime part of the trace starts here
83.   }
84.   
85. > static int process_pci_value(CONF_VALUE *val,
86.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
87.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:85:1: parameter `policy` of process_pci_value
  83.   }
  84.   
  85. > static int process_pci_value(CONF_VALUE *val,
  86.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  87.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:152:17: when calling `CRYPTO_free` here
  150.                    * too!
  151.                    */
  152.                   OPENSSL_free((*policy)->data);
                         ^
  153.                   (*policy)->data = NULL;
  154.                   (*policy)->length = 0;

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
    251.   }
    252.   
    253. > void CRYPTO_free(void *str, const char *file, int line)
    254.   {
    255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: invalid access occurs here
    267.       }
    268.   #else
    269.       free(str);
               ^
    270.   #endif
    271.   }
