test/ssltest_old.c:2915: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 2914 indirectly during the call to `CRYPTO_free()`.
Showing all 18 steps of the trace


test/ssltest_old.c:2649:14: invalidation part of the trace starts here
2647.       int err_in_server = 0;
2648.   
2649.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2650.   
2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2649:14: assigned
  2647.       int err_in_server = 0;
  2648.   
  2649.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2650.   
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2649:5: assigned
  2647.       int err_in_server = 0;
  2648.   
  2649.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2650.   
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2651:17: passed as argument to `CRYPTO_zalloc`
  2649.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2650.   
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2652.           goto err;
  2653.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2651:17: return from call to `CRYPTO_zalloc`
  2649.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2650.   
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2652.           goto err;
  2653.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2651:10: assigned
  2649.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2650.   
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2652.           goto err;
  2653.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2914:5: when calling `CRYPTO_free` here
  2912.       BIO_free_all(c_bio);
  2913.       BIO_free_all(s_bio);
  2914.       OPENSSL_free(cbuf);
              ^
  2915.       OPENSSL_free(sbuf);
  2916.   

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
    161.   }
    162.   
    163. > void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
    177.       }
    178.   #else
    179.       free(str);
               ^
    180.   #endif
    181.   }

test/ssltest_old.c:2649:14: use-after-lifetime part of the trace starts here
2647.       int err_in_server = 0;
2648.   
2649.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2650.   
2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2649:14: assigned
  2647.       int err_in_server = 0;
  2648.   
  2649.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2650.   
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2649:5: assigned
  2647.       int err_in_server = 0;
  2648.   
  2649.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2650.   
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2653:17: passed as argument to `CRYPTO_zalloc`
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2652.           goto err;
  2653.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2654.           goto err;
  2655.   

test/ssltest_old.c:2653:17: return from call to `CRYPTO_zalloc`
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2652.           goto err;
  2653.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2654.           goto err;
  2655.   

test/ssltest_old.c:2653:10: assigned
  2651.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2652.           goto err;
  2653.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2654.           goto err;
  2655.   

test/ssltest_old.c:2915:5: when calling `CRYPTO_free` here
  2913.       BIO_free_all(s_bio);
  2914.       OPENSSL_free(cbuf);
  2915.       OPENSSL_free(sbuf);
              ^
  2916.   
  2917.       if (should_negotiate != NULL && strcmp(should_negotiate, "fail-client") == 0)

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
    161.   }
    162.   
    163. > void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: invalid access occurs here
    177.       }
    178.   #else
    179.       free(str);
               ^
    180.   #endif
    181.   }
