crypto/asn1/x_name.c:185: error: USE_AFTER_FREE
  call to `X509_NAME_ENTRY_free()` eventually accesses memory that was invalidated by call to `free()` on line 185 indirectly during the call to `X509_NAME_ENTRY_free()`.
Showing all 30 steps of the trace


crypto/asn1/x_name.c:174:1: invalidation part of the trace starts here
172.   	}
173.   
174. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
175.   	{
176.   	int set=0,i;

crypto/asn1/x_name.c:174:1: parameter `a` of d2i_X509_NAME
  172.   	}
  173.   
  174. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  175.   	{
  176.   	int set=0,i;

crypto/asn1/x_name.c:179:2: assigned
  177.   	int idx=0;
  178.   	unsigned char *orig;
  179.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  180.   
  181.   	orig= *pp;

crypto/asn1/x_name.c:186:5: passed as argument to `sk_pop`
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  186.   				sk_pop(ret->entries));
             ^
  187.   		}
  188.   

crypto/stack/stack.c:254:1: parameter `st` of sk_pop
    252.   	}
    253.   
    254. > char *sk_pop(STACK *st)
    255.   	{
    256.   	if (st == NULL) return(NULL);

crypto/stack/stack.c:258:9: passed as argument to `sk_delete`
    256.   	if (st == NULL) return(NULL);
    257.   	if (st->num <= 0) return(NULL);
    258.   	return(sk_delete(st,st->num-1));
                   ^
    259.   	}
    260.   

crypto/stack/stack.c:182:1: parameter `st` of sk_delete
      180.   	}
      181.   
      182. > char *sk_delete(STACK *st, int loc)
      183.   	{
      184.   	char *ret;

crypto/stack/stack.c:195:4: assigned
      193.   		j=st->num-1;
      194.   		for (i=loc; i<j; i++)
      195.   			st->data[i]=st->data[i+1];
                ^
      196.   		/* In theory memcpy is not safe for this
      197.   		 * memcpy( &(st->data[loc]),

crypto/stack/stack.c:258:9: return from call to `sk_delete`
    256.   	if (st == NULL) return(NULL);
    257.   	if (st->num <= 0) return(NULL);
    258.   	return(sk_delete(st,st->num-1));
                   ^
    259.   	}
    260.   

crypto/asn1/x_name.c:186:5: return from call to `sk_pop`
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  186.   				sk_pop(ret->entries));
             ^
  187.   		}
  188.   

crypto/asn1/x_name.c:186:5: passed as argument to `sk_pop`
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  186.   				sk_pop(ret->entries));
             ^
  187.   		}
  188.   

crypto/asn1/x_name.c:186:5: return from call to `sk_pop`
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  186.   				sk_pop(ret->entries));
             ^
  187.   		}
  188.   

crypto/asn1/x_name.c:185:4: when calling `X509_NAME_ENTRY_free` here
  183.   		{
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
            ^
  186.   				sk_pop(ret->entries));
  187.   		}

crypto/asn1/x_name.c:251:1: parameter `a` of X509_NAME_ENTRY_free
    249.   	}
    250.   
    251. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    252.   	{
    253.   	if (a == NULL) return;

crypto/asn1/x_name.c:256:2: was invalidated by call to `free()`
    254.   	ASN1_OBJECT_free(a->object);
    255.   	ASN1_BIT_STRING_free(a->value);
    256.   	Free((char *)a);
            ^
    257.   	}
    258.   

crypto/asn1/x_name.c:174:1: use-after-lifetime part of the trace starts here
172.   	}
173.   
174. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
175.   	{
176.   	int set=0,i;

crypto/asn1/x_name.c:174:1: parameter `a` of d2i_X509_NAME
  172.   	}
  173.   
  174. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  175.   	{
  176.   	int set=0,i;

crypto/asn1/x_name.c:179:2: assigned
  177.   	int idx=0;
  178.   	unsigned char *orig;
  179.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  180.   
  181.   	orig= *pp;

crypto/asn1/x_name.c:186:5: passed as argument to `sk_pop`
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  186.   				sk_pop(ret->entries));
             ^
  187.   		}
  188.   

crypto/stack/stack.c:254:1: parameter `st` of sk_pop
    252.   	}
    253.   
    254. > char *sk_pop(STACK *st)
    255.   	{
    256.   	if (st == NULL) return(NULL);

crypto/stack/stack.c:258:9: passed as argument to `sk_delete`
    256.   	if (st == NULL) return(NULL);
    257.   	if (st->num <= 0) return(NULL);
    258.   	return(sk_delete(st,st->num-1));
                   ^
    259.   	}
    260.   

crypto/stack/stack.c:182:1: parameter `st` of sk_delete
      180.   	}
      181.   
      182. > char *sk_delete(STACK *st, int loc)
      183.   	{
      184.   	char *ret;

crypto/stack/stack.c:195:4: assigned
      193.   		j=st->num-1;
      194.   		for (i=loc; i<j; i++)
      195.   			st->data[i]=st->data[i+1];
                ^
      196.   		/* In theory memcpy is not safe for this
      197.   		 * memcpy( &(st->data[loc]),

crypto/stack/stack.c:258:9: return from call to `sk_delete`
    256.   	if (st == NULL) return(NULL);
    257.   	if (st->num <= 0) return(NULL);
    258.   	return(sk_delete(st,st->num-1));
                   ^
    259.   	}
    260.   

crypto/asn1/x_name.c:186:5: return from call to `sk_pop`
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  186.   				sk_pop(ret->entries));
             ^
  187.   		}
  188.   

crypto/asn1/x_name.c:186:5: passed as argument to `sk_pop`
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  186.   				sk_pop(ret->entries));
             ^
  187.   		}
  188.   

crypto/asn1/x_name.c:186:5: return from call to `sk_pop`
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  186.   				sk_pop(ret->entries));
             ^
  187.   		}
  188.   

crypto/asn1/x_name.c:185:4: when calling `X509_NAME_ENTRY_free` here
  183.   		{
  184.   		while (sk_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
            ^
  186.   				sk_pop(ret->entries));
  187.   		}

crypto/asn1/x_name.c:251:1: parameter `a` of X509_NAME_ENTRY_free
    249.   	}
    250.   
    251. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    252.   	{
    253.   	if (a == NULL) return;

crypto/asn1/x_name.c:256:2: invalid access occurs here
    254.   	ASN1_OBJECT_free(a->object);
    255.   	ASN1_BIT_STRING_free(a->value);
    256.   	Free((char *)a);
            ^
    257.   	}
    258.   
