crypto/asn1/asn_mime.c:409: error: USE_AFTER_FREE
  call to `sk_BIO_pop_free()` eventually accesses memory that was invalidated by call to `free()` on line 405 indirectly during the call to `multi_split()`.
Showing all 29 steps of the trace


crypto/asn1/asn_mime.c:374:5: invalidation part of the trace starts here
372.       BIO *asnin;
373.       STACK_OF(MIME_HEADER) *headers = NULL;
374.       STACK_OF(BIO) *parts = NULL;
           ^
375.       MIME_HEADER *hdr;
376.       MIME_PARAM *prm;

crypto/asn1/asn_mime.c:374:5: variable `parts` declared here
  372.       BIO *asnin;
  373.       STACK_OF(MIME_HEADER) *headers = NULL;
  374.       STACK_OF(BIO) *parts = NULL;
             ^
  375.       MIME_HEADER *hdr;
  376.       MIME_PARAM *prm;

crypto/asn1/asn_mime.c:405:15: when calling `multi_split` here
  403.               return NULL;
  404.           }
  405.           ret = multi_split(bio, prm->param_value, &parts);
                       ^
  406.           sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
  407.           if (!ret || (sk_BIO_num(parts) != 2)) {

crypto/asn1/asn_mime.c:573:13: passed as argument to `sk_BIO_new_null`
    571.       state = 0;
    572.       first = 1;
    573.       parts = sk_BIO_new_null();
                       ^
    574.       *ret = parts;
    575.       if (*ret == NULL)

crypto/asn1/asn_mime.c:573:13: return from call to `sk_BIO_new_null`
    571.       state = 0;
    572.       first = 1;
    573.       parts = sk_BIO_new_null();
                       ^
    574.       *ret = parts;
    575.       if (*ret == NULL)

crypto/asn1/asn_mime.c:573:5: assigned
    571.       state = 0;
    572.       first = 1;
    573.       parts = sk_BIO_new_null();
               ^
    574.       *ret = parts;
    575.       if (*ret == NULL)

crypto/asn1/asn_mime.c:583:18: when calling `sk_BIO_push` here
    581.               part++;
    582.           } else if (state == 2) {
    583.               if (!sk_BIO_push(parts, bpart)) {
                            ^
    584.                   BIO_free(bpart);
    585.                   return 0;

include/openssl/bio.h:260:1: parameter `sk` of sk_BIO_push
      258.   typedef void bio_info_cb(BIO *, int, const char *, int, long, long);
      259.   
      260. > DEFINE_STACK_OF(BIO)
      261.   
      262.   /* Prefix and suffix callback in ASN1 BIO */

include/openssl/bio.h:260:1: when calling `OPENSSL_sk_push` here
      258.   typedef void bio_info_cb(BIO *, int, const char *, int, long, long);
      259.   
      260. > DEFINE_STACK_OF(BIO)
      261.   
      262.   /* Prefix and suffix callback in ASN1 BIO */

crypto/stack/stack.c:307:1: parameter `st` of OPENSSL_sk_push
        305.   }
        306.   
        307. > int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)
        308.   {
        309.       if (st == NULL)

crypto/stack/stack.c:311:12: when calling `OPENSSL_sk_insert` here
        309.       if (st == NULL)
        310.           return -1;
        311.       return OPENSSL_sk_insert(st, data, st->num);
                          ^
        312.   }
        313.   

crypto/stack/stack.c:222:1: parameter `st` of OPENSSL_sk_insert
          220.   }
          221.   
          222. > int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)
          223.   {
          224.       if (st == NULL || st->num < 0 || st->num == max_nodes)

crypto/stack/stack.c:227:10: when calling `sk_reserve` here
          225.           return 0;
          226.   
          227.       if (!sk_reserve(st, 1, 0))
                          ^
          228.           return 0;
          229.   

crypto/stack/stack.c:166:1: parameter `st` of sk_reserve
            164.   
            165.   /* internal STACK storage allocation */
            166. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
            167.   {
            168.       const void **tmpdata;

crypto/stack/stack.c:203:15: when calling `CRYPTO_realloc` here
            201.       }
            202.   
            203.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                                 ^
            204.       if (tmpdata == NULL)
            205.           return 0;

crypto/mem.c:208:1: parameter `str` of CRYPTO_realloc
              206.   }
              207.   
              208. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
              209.   {
              210.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:218:9: when calling `CRYPTO_free` here
              216.   
              217.       if (num == 0) {
              218.           CRYPTO_free(str, file, line);
                             ^
              219.           return NULL;
              220.       }

crypto/mem.c:265:1: parameter `str` of CRYPTO_free
                263.   }
                264.   
                265. > void CRYPTO_free(void *str, const char *file, int line)
                266.   {
                267.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:281:5: was invalidated by call to `free()`
                279.       }
                280.   #else
                281.       free(str);
                           ^
                282.   #endif
                283.   }

crypto/asn1/asn_mime.c:374:5: use-after-lifetime part of the trace starts here
372.       BIO *asnin;
373.       STACK_OF(MIME_HEADER) *headers = NULL;
374.       STACK_OF(BIO) *parts = NULL;
           ^
375.       MIME_HEADER *hdr;
376.       MIME_PARAM *prm;

crypto/asn1/asn_mime.c:374:5: variable `parts` declared here
  372.       BIO *asnin;
  373.       STACK_OF(MIME_HEADER) *headers = NULL;
  374.       STACK_OF(BIO) *parts = NULL;
             ^
  375.       MIME_HEADER *hdr;
  376.       MIME_PARAM *prm;

crypto/asn1/asn_mime.c:405:15: passed as argument to `multi_split`
  403.               return NULL;
  404.           }
  405.           ret = multi_split(bio, prm->param_value, &parts);
                       ^
  406.           sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
  407.           if (!ret || (sk_BIO_num(parts) != 2)) {

crypto/asn1/asn_mime.c:573:13: passed as argument to `sk_BIO_new_null`
    571.       state = 0;
    572.       first = 1;
    573.       parts = sk_BIO_new_null();
                       ^
    574.       *ret = parts;
    575.       if (*ret == NULL)

crypto/asn1/asn_mime.c:573:13: return from call to `sk_BIO_new_null`
    571.       state = 0;
    572.       first = 1;
    573.       parts = sk_BIO_new_null();
                       ^
    574.       *ret = parts;
    575.       if (*ret == NULL)

crypto/asn1/asn_mime.c:573:5: assigned
    571.       state = 0;
    572.       first = 1;
    573.       parts = sk_BIO_new_null();
               ^
    574.       *ret = parts;
    575.       if (*ret == NULL)

crypto/asn1/asn_mime.c:405:15: return from call to `multi_split`
  403.               return NULL;
  404.           }
  405.           ret = multi_split(bio, prm->param_value, &parts);
                       ^
  406.           sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
  407.           if (!ret || (sk_BIO_num(parts) != 2)) {

crypto/asn1/asn_mime.c:409:13: when calling `sk_BIO_pop_free` here
  407.           if (!ret || (sk_BIO_num(parts) != 2)) {
  408.               ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_MULTIPART_BODY_FAILURE);
  409.               sk_BIO_pop_free(parts, BIO_vfree);
                     ^
  410.               return NULL;
  411.           }

crypto/mem.c:265:1: parameter `str` of CRYPTO_free
    263.   }
    264.   
    265. > void CRYPTO_free(void *str, const char *file, int line)
    266.   {
    267.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:281:5: invalid access occurs here
    279.       }
    280.   #else
    281.       free(str);
               ^
    282.   #endif
    283.   }
