crypto/lhash/lhash.c:166: error: USE_AFTER_FREE
  call to `getrn()` eventually accesses memory that was invalidated by call to `free()` on line 164 indirectly during the call to `expand()`.
Showing all 14 steps of the trace


crypto/lhash/lhash.c:156:1: invalidation part of the trace starts here
154.   }
155.   
156. > void *lh_insert(_LHASH *lh, void *data)
157.   {
158.       unsigned long hash;

crypto/lhash/lhash.c:156:1: parameter `lh` of lh_insert
  154.   }
  155.   
  156. > void *lh_insert(_LHASH *lh, void *data)
  157.   {
  158.       unsigned long hash;

crypto/lhash/lhash.c:164:9: when calling `expand` here
  162.       lh->error = 0;
  163.       if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))
  164.           expand(lh);
                 ^
  165.   
  166.       rn = getrn(lh, data, &hash);

crypto/lhash/lhash.c:279:1: parameter `lh` of expand
    277.   }
    278.   
    279. > static void expand(_LHASH *lh)
    280.   {
    281.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:306:13: when calling `CRYPTO_realloc` here
    304.       if ((lh->p) >= lh->pmax) {
    305.           j = (int)lh->num_alloc_nodes * 2;
    306.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
                       ^
    307.           if (n == NULL) {
    308.               /* fputs("realloc error in lhash",stderr); */

crypto/mem.c:166:1: parameter `str` of CRYPTO_realloc
      164.   }
      165.   
      166. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      167.   {
      168.       if (str == NULL)

crypto/mem.c:172:9: when calling `CRYPTO_free` here
      170.   
      171.       if (num == 0) {
      172.           CRYPTO_free(str);
                     ^
      173.           return NULL;
      174.       }

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
        232.   }
        233.   
        234. > void CRYPTO_free(void *str)
        235.   {
        236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: was invalidated by call to `free()`
        243.       }
        244.   #else
        245.       free(str);
                   ^
        246.   #endif
        247.   }

crypto/lhash/lhash.c:156:1: use-after-lifetime part of the trace starts here
154.   }
155.   
156. > void *lh_insert(_LHASH *lh, void *data)
157.   {
158.       unsigned long hash;

crypto/lhash/lhash.c:156:1: parameter `lh` of lh_insert
  154.   }
  155.   
  156. > void *lh_insert(_LHASH *lh, void *data)
  157.   {
  158.       unsigned long hash;

crypto/lhash/lhash.c:166:10: when calling `getrn` here
  164.           expand(lh);
  165.   
  166.       rn = getrn(lh, data, &hash);
                  ^
  167.   
  168.       if (*rn == NULL) {

crypto/lhash/lhash.c:358:1: parameter `lh` of getrn
    356.   }
    357.   
    358. > static LHASH_NODE **getrn(_LHASH *lh, const void *data, unsigned long *rhash)
    359.   {
    360.       LHASH_NODE **ret, *n1;

crypto/lhash/lhash.c:373:5: invalid access occurs here
    371.   
    372.       cf = lh->comp;
    373.       ret = &(lh->b[(int)nn]);
               ^
    374.       for (n1 = *ret; n1 != NULL; n1 = n1->next) {
    375.           lh->num_hash_comps++;
