crypto/asn1/asn_mime.c:433: error: USE_AFTER_FREE
  call to `mime_hdr_find()` eventually accesses memory that was invalidated by call to `free()` on line 428 indirectly during the call to `mime_parse_hdr()`.
Showing all 29 steps of the trace


crypto/asn1/asn_mime.c:428:20: invalidation part of the trace starts here
426.           *bcont = NULL;
427.   
428.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                          ^
429.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
430.           return NULL;

crypto/asn1/asn_mime.c:428:20: when calling `mime_parse_hdr` here
  426.           *bcont = NULL;
  427.   
  428.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                            ^
  429.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
  430.           return NULL;

crypto/asn1/asn_mime.c:677:15: passed as argument to `sk_MIME_HEADER_new`
    675.       int len, state, save_state = 0;
    676.   
    677.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
                         ^
    678.       if (headers == NULL)
    679.           return NULL;

crypto/asn1/asn_mime.c:677:15: return from call to `sk_MIME_HEADER_new`
    675.       int len, state, save_state = 0;
    676.   
    677.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
                         ^
    678.       if (headers == NULL)
    679.           return NULL;

crypto/asn1/asn_mime.c:677:5: assigned
    675.       int len, state, save_state = 0;
    676.   
    677.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
               ^
    678.       if (headers == NULL)
    679.           return NULL;

crypto/asn1/asn_mime.c:711:21: when calling `sk_MIME_HEADER_push` here
    709.                       *p = 0;
    710.                       mhdr = mime_hdr_new(ntmp, strip_ends(q));
    711.                       sk_MIME_HEADER_push(headers, mhdr);
                               ^
    712.                       ntmp = NULL;
    713.                       q = p + 1;

crypto/asn1/asn1_locl.h:93:1: parameter `sk` of sk_MIME_HEADER_push
      91.   DEFINE_STACK_OF(MIME_PARAM)
      92.   typedef struct mime_header_st MIME_HEADER;
      93. > DEFINE_STACK_OF(MIME_HEADER)
      94.   
      95.   /* Month values for printing out times */

crypto/asn1/asn1_locl.h:93:1: when calling `sk_push` here
      91.   DEFINE_STACK_OF(MIME_PARAM)
      92.   typedef struct mime_header_st MIME_HEADER;
      93. > DEFINE_STACK_OF(MIME_HEADER)
      94.   
      95.   /* Month values for printing out times */

crypto/stack/stack.c:259:1: parameter `st` of sk_push
        257.   }
        258.   
        259. > int sk_push(_STACK *st, void *data)
        260.   {
        261.       return (sk_insert(st, data, st->num));

crypto/stack/stack.c:261:13: when calling `sk_insert` here
        259.   int sk_push(_STACK *st, void *data)
        260.   {
        261.       return (sk_insert(st, data, st->num));
                           ^
        262.   }
        263.   

crypto/stack/stack.c:167:1: parameter `st` of sk_insert
          165.   }
          166.   
          167. > int sk_insert(_STACK *st, void *data, int loc)
          168.   {
          169.       char **s;

crypto/stack/stack.c:174:13: when calling `CRYPTO_realloc` here
          172.           return 0;
          173.       if (st->num_alloc <= st->num + 1) {
          174.           s = OPENSSL_realloc((char *)st->data,
                             ^
          175.                               (unsigned int)sizeof(char *) * st->num_alloc * 2);
          176.           if (s == NULL)

crypto/mem.c:166:1: parameter `str` of CRYPTO_realloc
            164.   }
            165.   
            166. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            167.   {
            168.       if (str == NULL)

crypto/mem.c:172:9: when calling `CRYPTO_free` here
            170.   
            171.       if (num == 0) {
            172.           CRYPTO_free(str);
                           ^
            173.           return NULL;
            174.       }

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
              232.   }
              233.   
              234. > void CRYPTO_free(void *str)
              235.   {
              236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: was invalidated by call to `free()`
              243.       }
              244.   #else
              245.       free(str);
                         ^
              246.   #endif
              247.   }

crypto/asn1/asn_mime.c:428:20: use-after-lifetime part of the trace starts here
426.           *bcont = NULL;
427.   
428.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                          ^
429.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
430.           return NULL;

crypto/asn1/asn_mime.c:428:20: passed as argument to `mime_parse_hdr`
  426.           *bcont = NULL;
  427.   
  428.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                            ^
  429.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
  430.           return NULL;

crypto/asn1/asn_mime.c:677:15: passed as argument to `sk_MIME_HEADER_new`
    675.       int len, state, save_state = 0;
    676.   
    677.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
                         ^
    678.       if (headers == NULL)
    679.           return NULL;

crypto/asn1/asn_mime.c:677:15: return from call to `sk_MIME_HEADER_new`
    675.       int len, state, save_state = 0;
    676.   
    677.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
                         ^
    678.       if (headers == NULL)
    679.           return NULL;

crypto/asn1/asn_mime.c:677:5: assigned
    675.       int len, state, save_state = 0;
    676.   
    677.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
               ^
    678.       if (headers == NULL)
    679.           return NULL;

crypto/asn1/asn_mime.c:428:20: return from call to `mime_parse_hdr`
  426.           *bcont = NULL;
  427.   
  428.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                            ^
  429.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
  430.           return NULL;

crypto/asn1/asn_mime.c:433:16: when calling `mime_hdr_find` here
  431.       }
  432.   
  433.       if ((hdr = mime_hdr_find(headers, "content-type")) == NULL
                        ^
  434.           || hdr->value == NULL) {
  435.           sk_MIME_HEADER_pop_free(headers, mime_hdr_free);

crypto/asn1/asn_mime.c:922:1: parameter `hdrs` of mime_hdr_find
    920.   /* Find a header with a given name (if possible) */
    921.   
    922. > static MIME_HEADER *mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, char *name)
    923.   {
    924.       MIME_HEADER htmp;

crypto/asn1/asn_mime.c:930:12: when calling `sk_MIME_HEADER_value` here
    928.       if (idx < 0)
    929.           return NULL;
    930.       return sk_MIME_HEADER_value(hdrs, idx);
                      ^
    931.   }
    932.   

crypto/asn1/asn1_locl.h:93:1: parameter `sk` of sk_MIME_HEADER_value
      91.   DEFINE_STACK_OF(MIME_PARAM)
      92.   typedef struct mime_header_st MIME_HEADER;
      93. > DEFINE_STACK_OF(MIME_HEADER)
      94.   
      95.   /* Month values for printing out times */

crypto/asn1/asn1_locl.h:93:1: when calling `sk_value` here
      91.   DEFINE_STACK_OF(MIME_PARAM)
      92.   typedef struct mime_header_st MIME_HEADER;
      93. > DEFINE_STACK_OF(MIME_HEADER)
      94.   
      95.   /* Month values for printing out times */

crypto/stack/stack.c:324:1: parameter `st` of sk_value
        322.   }
        323.   
        324. > void *sk_value(const _STACK *st, int i)
        325.   {
        326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:328:12: invalid access occurs here
        326.       if (!st || (i < 0) || (i >= st->num))
        327.           return NULL;
        328.       return st->data[i];
                          ^
        329.   }
        330.   
