ssl/t1_ext.c:183: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 179 indirectly during the call to `CRYPTO_realloc()`.
Showing all 12 steps of the trace


ssl/t1_ext.c:152:1: invalidation part of the trace starts here
150.   
151.   /* Set callbacks for a custom extension. */
152. > static int custom_ext_meth_add(custom_ext_methods *exts,
153.                                  unsigned int ext_type,
154.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:152:1: parameter `exts` of custom_ext_meth_add
  150.   
  151.   /* Set callbacks for a custom extension. */
  152. > static int custom_ext_meth_add(custom_ext_methods *exts,
  153.                                  unsigned int ext_type,
  154.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:179:11: when calling `CRYPTO_realloc` here
  177.       if (custom_ext_find(exts, ext_type))
  178.           return 0;
  179.       tmp = OPENSSL_realloc(exts->meths,
                   ^
  180.                             (exts->meths_count + 1) * sizeof(custom_ext_method));
  181.   

crypto/mem.c:107:1: parameter `str` of CRYPTO_realloc
    105.   }
    106.   
    107. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    108.   {
    109.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:116:9: when calling `CRYPTO_free` here
    114.   
    115.       if (num == 0) {
    116.           CRYPTO_free(str, file, line);
                   ^
    117.           return NULL;
    118.       }

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
      161.   }
      162.   
      163. > void CRYPTO_free(void *str, const char *file, int line)
      164.   {
      165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
      177.       }
      178.   #else
      179.       free(str);
                 ^
      180.   #endif
      181.   }

ssl/t1_ext.c:152:1: use-after-lifetime part of the trace starts here
150.   
151.   /* Set callbacks for a custom extension. */
152. > static int custom_ext_meth_add(custom_ext_methods *exts,
153.                                  unsigned int ext_type,
154.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:152:1: parameter `exts` of custom_ext_meth_add
  150.   
  151.   /* Set callbacks for a custom extension. */
  152. > static int custom_ext_meth_add(custom_ext_methods *exts,
  153.                                  unsigned int ext_type,
  154.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:183:9: when calling `CRYPTO_free` here
  181.   
  182.       if (tmp == NULL) {
  183.           OPENSSL_free(exts->meths);
                 ^
  184.           exts->meths = NULL;
  185.           exts->meths_count = 0;

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
    161.   }
    162.   
    163. > void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: invalid access occurs here
    177.       }
    178.   #else
    179.       free(str);
               ^
    180.   #endif
    181.   }
