crypto/ct/ct_oct.c:357: error: USE_AFTER_FREE
  call to `SCT_free()` eventually accesses memory that was invalidated by call to `free()` on line 357 indirectly during the call to `SCT_free()`.
Showing all 22 steps of the trace


crypto/ct/ct_oct.c:330:1: invalidation part of the trace starts here
328.   }
329.   
330. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
331.                               size_t len)
332.   {

crypto/ct/ct_oct.c:330:1: parameter `a` of o2i_SCT_LIST
  328.   }
  329.   
  330. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
  331.                               size_t len)
  332.   {

crypto/ct/ct_oct.c:355:9: assigned
  353.   
  354.           /* Use the given stack, but empty it first. */
  355.           sk = *a;
                 ^
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
  357.               SCT_free(sct);

crypto/ct/ct_oct.c:356:23: passed as argument to `sk_SCT_pop`
  354.           /* Use the given stack, but empty it first. */
  355.           sk = *a;
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  357.               SCT_free(sct);
  358.       }

crypto/ct/ct_oct.c:356:23: return from call to `sk_SCT_pop`
  354.           /* Use the given stack, but empty it first. */
  355.           sk = *a;
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  357.               SCT_free(sct);
  358.       }

crypto/ct/ct_oct.c:356:17: assigned
  354.           /* Use the given stack, but empty it first. */
  355.           sk = *a;
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
                         ^
  357.               SCT_free(sct);
  358.       }

crypto/ct/ct_oct.c:357:13: when calling `SCT_free` here
  355.           sk = *a;
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
  357.               SCT_free(sct);
                     ^
  358.       }
  359.   

crypto/ct/ct_sct.c:85:1: parameter `sct` of SCT_free
    83.   }
    84.   
    85. > void SCT_free(SCT *sct)
    86.   {
    87.       if (sct == NULL)

crypto/ct/ct_sct.c:91:5: when calling `CRYPTO_free` here
    89.   
    90.       OPENSSL_free(sct->log_id);
    91.       OPENSSL_free(sct->ext);
              ^
    92.       OPENSSL_free(sct->sig);
    93.       OPENSSL_free(sct->sct);

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
      208.   }
      209.   
      210. > void CRYPTO_free(void *str, const char *file, int line)
      211.   {
      212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: was invalidated by call to `free()`
      224.       }
      225.   #else
      226.       free(str);
                 ^
      227.   #endif
      228.   }

crypto/ct/ct_oct.c:330:1: use-after-lifetime part of the trace starts here
328.   }
329.   
330. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
331.                               size_t len)
332.   {

crypto/ct/ct_oct.c:330:1: parameter `a` of o2i_SCT_LIST
  328.   }
  329.   
  330. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
  331.                               size_t len)
  332.   {

crypto/ct/ct_oct.c:355:9: assigned
  353.   
  354.           /* Use the given stack, but empty it first. */
  355.           sk = *a;
                 ^
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
  357.               SCT_free(sct);

crypto/ct/ct_oct.c:356:23: passed as argument to `sk_SCT_pop`
  354.           /* Use the given stack, but empty it first. */
  355.           sk = *a;
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  357.               SCT_free(sct);
  358.       }

crypto/ct/ct_oct.c:356:23: return from call to `sk_SCT_pop`
  354.           /* Use the given stack, but empty it first. */
  355.           sk = *a;
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  357.               SCT_free(sct);
  358.       }

crypto/ct/ct_oct.c:356:17: assigned
  354.           /* Use the given stack, but empty it first. */
  355.           sk = *a;
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
                         ^
  357.               SCT_free(sct);
  358.       }

crypto/ct/ct_oct.c:357:13: when calling `SCT_free` here
  355.           sk = *a;
  356.           while ((sct = sk_SCT_pop(sk)) != NULL)
  357.               SCT_free(sct);
                     ^
  358.       }
  359.   

crypto/ct/ct_sct.c:85:1: parameter `sct` of SCT_free
    83.   }
    84.   
    85. > void SCT_free(SCT *sct)
    86.   {
    87.       if (sct == NULL)

crypto/ct/ct_sct.c:91:5: when calling `CRYPTO_free` here
    89.   
    90.       OPENSSL_free(sct->log_id);
    91.       OPENSSL_free(sct->ext);
              ^
    92.       OPENSSL_free(sct->sig);
    93.       OPENSSL_free(sct->sct);

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
      208.   }
      209.   
      210. > void CRYPTO_free(void *str, const char *file, int line)
      211.   {
      212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: invalid access occurs here
      224.       }
      225.   #else
      226.       free(str);
                 ^
      227.   #endif
      228.   }
