crypto/x509v3/v3_conf.c:291: error: USE_AFTER_FREE
  call to `X509_EXTENSION_free()` eventually accesses memory that was invalidated by call to `free()` on line 291 indirectly during the call to `X509_EXTENSION_free()`.
Showing all 22 steps of the trace


crypto/x509v3/v3_conf.c:283:1: invalidation part of the trace starts here
281.   }
282.   
283. > static void delete_ext(STACK_OF(X509_EXTENSION) *sk, X509_EXTENSION *dext)
284.   {
285.       int idx;

crypto/x509v3/v3_conf.c:283:1: parameter `sk` of delete_ext
  281.   }
  282.   
  283. > static void delete_ext(STACK_OF(X509_EXTENSION) *sk, X509_EXTENSION *dext)
  284.   {
  285.       int idx;

crypto/x509v3/v3_conf.c:289:34: passed as argument to `X509v3_get_ext`
  287.       obj = X509_EXTENSION_get_object(dext);
  288.       while ((idx = X509v3_get_ext_by_OBJ(sk, obj, -1)) >= 0) {
  289.           X509_EXTENSION *tmpext = X509v3_get_ext(sk, idx);
                                          ^
  290.           X509v3_delete_ext(sk, idx);
  291.           X509_EXTENSION_free(tmpext);

crypto/x509v3/v3_conf.c:289:34: return from call to `X509v3_get_ext`
  287.       obj = X509_EXTENSION_get_object(dext);
  288.       while ((idx = X509v3_get_ext_by_OBJ(sk, obj, -1)) >= 0) {
  289.           X509_EXTENSION *tmpext = X509v3_get_ext(sk, idx);
                                          ^
  290.           X509v3_delete_ext(sk, idx);
  291.           X509_EXTENSION_free(tmpext);

crypto/x509v3/v3_conf.c:289:9: assigned
  287.       obj = X509_EXTENSION_get_object(dext);
  288.       while ((idx = X509v3_get_ext_by_OBJ(sk, obj, -1)) >= 0) {
  289.           X509_EXTENSION *tmpext = X509v3_get_ext(sk, idx);
                 ^
  290.           X509v3_delete_ext(sk, idx);
  291.           X509_EXTENSION_free(tmpext);

crypto/x509v3/v3_conf.c:291:9: when calling `X509_EXTENSION_free` here
  289.           X509_EXTENSION *tmpext = X509v3_get_ext(sk, idx);
  290.           X509v3_delete_ext(sk, idx);
  291.           X509_EXTENSION_free(tmpext);
                 ^
  292.       }
  293.   }

crypto/x509/x_exten.c:26:1: parameter `a` of X509_EXTENSION_free
    24.   ASN1_ITEM_TEMPLATE_END(X509_EXTENSIONS)
    25.   
    26. > IMPLEMENT_ASN1_FUNCTIONS(X509_EXTENSION)
    27.   IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_EXTENSIONS, X509_EXTENSIONS, X509_EXTENSIONS)
    28.   IMPLEMENT_ASN1_DUP_FUNCTION(X509_EXTENSION)

crypto/x509/x_exten.c:26:1: when calling `ASN1_item_free` here
    24.   ASN1_ITEM_TEMPLATE_END(X509_EXTENSIONS)
    25.   
    26. > IMPLEMENT_ASN1_FUNCTIONS(X509_EXTENSION)
    27.   IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_EXTENSIONS, X509_EXTENSIONS, X509_EXTENSIONS)
    28.   IMPLEMENT_ASN1_DUP_FUNCTION(X509_EXTENSION)

crypto/asn1/tasn_fre.c:18:1: parameter `val` of ASN1_item_free
      16.   /* Free up an ASN1 structure */
      17.   
      18. > void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
      19.   {
      20.       asn1_item_embed_free(&val, it, 0);

crypto/asn1/tasn_fre.c:20:5: when calling `asn1_item_embed_free` here
      18.   void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
      19.   {
      20.       asn1_item_embed_free(&val, it, 0);
                ^
      21.   }
      22.   

crypto/asn1/tasn_fre.c:28:1: parameter `pval` of asn1_item_embed_free
        26.   }
        27.   
        28. > void asn1_item_embed_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int embed)
        29.   {
        30.       const ASN1_TEMPLATE *tt = NULL, *seqtt;

crypto/asn1/tasn_fre.c:115:13: when calling `CRYPTO_free` here
        113.               asn1_cb(ASN1_OP_FREE_POST, pval, it, NULL);
        114.           if (embed == 0) {
        115.               OPENSSL_free(*pval);
                           ^
        116.               *pval = NULL;
        117.           }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
          293.   }
          294.   
          295. > void CRYPTO_free(void *str, const char *file, int line)
          296.   {
          297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
          310.       }
          311.   #else
          312.       free(str);
                     ^
          313.   #endif
          314.   }

crypto/x509v3/v3_conf.c:283:1: use-after-lifetime part of the trace starts here
281.   }
282.   
283. > static void delete_ext(STACK_OF(X509_EXTENSION) *sk, X509_EXTENSION *dext)
284.   {
285.       int idx;

crypto/x509v3/v3_conf.c:283:1: parameter `sk` of delete_ext
  281.   }
  282.   
  283. > static void delete_ext(STACK_OF(X509_EXTENSION) *sk, X509_EXTENSION *dext)
  284.   {
  285.       int idx;

crypto/x509v3/v3_conf.c:289:34: passed as argument to `X509v3_get_ext`
  287.       obj = X509_EXTENSION_get_object(dext);
  288.       while ((idx = X509v3_get_ext_by_OBJ(sk, obj, -1)) >= 0) {
  289.           X509_EXTENSION *tmpext = X509v3_get_ext(sk, idx);
                                          ^
  290.           X509v3_delete_ext(sk, idx);
  291.           X509_EXTENSION_free(tmpext);

crypto/x509v3/v3_conf.c:289:34: return from call to `X509v3_get_ext`
  287.       obj = X509_EXTENSION_get_object(dext);
  288.       while ((idx = X509v3_get_ext_by_OBJ(sk, obj, -1)) >= 0) {
  289.           X509_EXTENSION *tmpext = X509v3_get_ext(sk, idx);
                                          ^
  290.           X509v3_delete_ext(sk, idx);
  291.           X509_EXTENSION_free(tmpext);

crypto/x509v3/v3_conf.c:289:9: assigned
  287.       obj = X509_EXTENSION_get_object(dext);
  288.       while ((idx = X509v3_get_ext_by_OBJ(sk, obj, -1)) >= 0) {
  289.           X509_EXTENSION *tmpext = X509v3_get_ext(sk, idx);
                 ^
  290.           X509v3_delete_ext(sk, idx);
  291.           X509_EXTENSION_free(tmpext);

crypto/x509v3/v3_conf.c:291:9: when calling `X509_EXTENSION_free` here
  289.           X509_EXTENSION *tmpext = X509v3_get_ext(sk, idx);
  290.           X509v3_delete_ext(sk, idx);
  291.           X509_EXTENSION_free(tmpext);
                 ^
  292.       }
  293.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }
