crypto/lhash/lhash.c:80: error: USE_AFTER_FREE
  call to `getrn()` eventually accesses memory that was invalidated by call to `free()` on line 78 indirectly during the call to `expand()`.
Showing all 14 steps of the trace


crypto/lhash/lhash.c:70:1: invalidation part of the trace starts here
68.   }
69.   
70. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
71.   {
72.       unsigned long hash;

crypto/lhash/lhash.c:70:1: parameter `lh` of OPENSSL_LH_insert
  68.   }
  69.   
  70. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
  71.   {
  72.       unsigned long hash;

crypto/lhash/lhash.c:78:9: when calling `expand` here
  76.       lh->error = 0;
  77.       if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))
  78.           expand(lh);
                ^
  79.   
  80.       rn = getrn(lh, data, &hash);

crypto/lhash/lhash.c:187:1: parameter `lh` of expand
    185.   }
    186.   
    187. > static void expand(OPENSSL_LHASH *lh)
    188.   {
    189.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:214:13: when calling `CRYPTO_realloc` here
    212.       if ((lh->p) >= lh->pmax) {
    213.           j = (int)lh->num_alloc_nodes * 2;
    214.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                       ^
    215.           if (n == NULL) {
    216.               /* fputs("realloc error in lhash",stderr); */

crypto/mem.c:107:1: parameter `str` of CRYPTO_realloc
      105.   }
      106.   
      107. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      108.   {
      109.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:116:9: when calling `CRYPTO_free` here
      114.   
      115.       if (num == 0) {
      116.           CRYPTO_free(str, file, line);
                     ^
      117.           return NULL;
      118.       }

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
        161.   }
        162.   
        163. > void CRYPTO_free(void *str, const char *file, int line)
        164.   {
        165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
        177.       }
        178.   #else
        179.       free(str);
                   ^
        180.   #endif
        181.   }

crypto/lhash/lhash.c:70:1: use-after-lifetime part of the trace starts here
68.   }
69.   
70. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
71.   {
72.       unsigned long hash;

crypto/lhash/lhash.c:70:1: parameter `lh` of OPENSSL_LH_insert
  68.   }
  69.   
  70. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
  71.   {
  72.       unsigned long hash;

crypto/lhash/lhash.c:80:10: when calling `getrn` here
  78.           expand(lh);
  79.   
  80.       rn = getrn(lh, data, &hash);
                 ^
  81.   
  82.       if (*rn == NULL) {

crypto/lhash/lhash.c:266:1: parameter `lh` of getrn
    264.   }
    265.   
    266. > static OPENSSL_LH_NODE **getrn(OPENSSL_LHASH *lh,
    267.                                  const void *data, unsigned long *rhash)
    268.   {

crypto/lhash/lhash.c:282:5: invalid access occurs here
    280.   
    281.       cf = lh->comp;
    282.       ret = &(lh->b[(int)nn]);
               ^
    283.       for (n1 = *ret; n1 != NULL; n1 = n1->next) {
    284.           lh->num_hash_comps++;
