crypto/stack/stack.c:107: error: USE_AFTER_FREE
  call to `sk_free()` eventually accesses memory that was invalidated by call to `free()` on line 94 indirectly during the call to `CRYPTO_realloc()`.
Showing all 14 steps of the trace


crypto/stack/stack.c:92:10: invalidation part of the trace starts here
90.       char **s;
91.   
92.       if ((ret = sk_new(sk->comp)) == NULL)
               ^
93.           goto err;
94.       s = OPENSSL_realloc((char *)ret->data,

crypto/stack/stack.c:92:10: assigned
  90.       char **s;
  91.   
  92.       if ((ret = sk_new(sk->comp)) == NULL)
                 ^
  93.           goto err;
  94.       s = OPENSSL_realloc((char *)ret->data,

crypto/stack/stack.c:94:9: when calling `CRYPTO_realloc` here
  92.       if ((ret = sk_new(sk->comp)) == NULL)
  93.           goto err;
  94.       s = OPENSSL_realloc((char *)ret->data,
                ^
  95.                           (unsigned int)sizeof(char *) * sk->num_alloc);
  96.       if (s == NULL)

crypto/mem.c:166:1: parameter `str` of CRYPTO_realloc
    164.   }
    165.   
    166. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    167.   {
    168.       if (str == NULL)

crypto/mem.c:172:9: when calling `CRYPTO_free` here
    170.   
    171.       if (num == 0) {
    172.           CRYPTO_free(str);
                   ^
    173.           return NULL;
    174.       }

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
      232.   }
      233.   
      234. > void CRYPTO_free(void *str)
      235.   {
      236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: was invalidated by call to `free()`
      243.       }
      244.   #else
      245.       free(str);
                 ^
      246.   #endif
      247.   }

crypto/stack/stack.c:92:10: use-after-lifetime part of the trace starts here
90.       char **s;
91.   
92.       if ((ret = sk_new(sk->comp)) == NULL)
               ^
93.           goto err;
94.       s = OPENSSL_realloc((char *)ret->data,

crypto/stack/stack.c:92:10: assigned
  90.       char **s;
  91.   
  92.       if ((ret = sk_new(sk->comp)) == NULL)
                 ^
  93.           goto err;
  94.       s = OPENSSL_realloc((char *)ret->data,

crypto/stack/stack.c:107:5: when calling `sk_free` here
  105.       return (ret);
  106.    err:
  107.       sk_free(ret);
             ^
  108.       return (NULL);
  109.   }

crypto/stack/stack.c:309:1: parameter `st` of sk_free
    307.   }
    308.   
    309. > void sk_free(_STACK *st)
    310.   {
    311.       if (st == NULL)

crypto/stack/stack.c:313:5: when calling `CRYPTO_free` here
    311.       if (st == NULL)
    312.           return;
    313.       OPENSSL_free(st->data);
               ^
    314.       OPENSSL_free(st);
    315.   }

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
      232.   }
      233.   
      234. > void CRYPTO_free(void *str)
      235.   {
      236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: invalid access occurs here
      243.       }
      244.   #else
      245.       free(str);
                 ^
      246.   #endif
      247.   }
