crypto/asn1/evp_asn1.c:22: error: USE_AFTER_FREE
  call to `ASN1_OCTET_STRING_free()` eventually accesses memory that was invalidated by call to `free()` on line 21 indirectly during the call to `ASN1_OCTET_STRING_set()`.
Showing all 29 steps of the trace


crypto/asn1/evp_asn1.c:19:15: invalidation part of the trace starts here
17.       ASN1_STRING *os;
18.   
19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                    ^
20.           return 0;
21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:19:15: passed as argument to `ASN1_OCTET_STRING_new`
  17.       ASN1_STRING *os;
  18.   
  19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                      ^
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:19:15: return from call to `ASN1_OCTET_STRING_new`
  17.       ASN1_STRING *os;
  18.   
  19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                      ^
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:19:10: assigned
  17.       ASN1_STRING *os;
  18.   
  19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                 ^
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:21:10: when calling `ASN1_OCTET_STRING_set` here
  19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {
                 ^
  22.           ASN1_OCTET_STRING_free(os);
  23.           return 0;

crypto/asn1/a_octet.c:25:1: parameter `x` of ASN1_OCTET_STRING_set
    23.   }
    24.   
    25. > int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d,
    26.                             int len)
    27.   {

crypto/asn1/a_octet.c:28:12: when calling `ASN1_STRING_set` here
    26.                             int len)
    27.   {
    28.       return ASN1_STRING_set(x, d, len);
                     ^
    29.   }

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
      269.   }
      270.   
      271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
      272.   {
      273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
      281.       }
      282.       if ((str->length <= len) || (str->data == NULL)) {
      283.           c = str->data;
                     ^
      284.           str->data = OPENSSL_realloc(c, len + 1);
      285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:284:21: when calling `CRYPTO_realloc` here
      282.       if ((str->length <= len) || (str->data == NULL)) {
      283.           c = str->data;
      284.           str->data = OPENSSL_realloc(c, len + 1);
                                 ^
      285.           if (str->data == NULL) {
      286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
        236.   }
        237.   
        238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
        239.   {
        240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
        247.   
        248.       if (num == 0) {
        249.           CRYPTO_free(str, file, line);
                       ^
        250.           return NULL;
        251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
          293.   }
          294.   
          295. > void CRYPTO_free(void *str, const char *file, int line)
          296.   {
          297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
          310.       }
          311.   #else
          312.       free(str);
                     ^
          313.   #endif
          314.   }

crypto/asn1/evp_asn1.c:19:15: use-after-lifetime part of the trace starts here
17.       ASN1_STRING *os;
18.   
19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                    ^
20.           return 0;
21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:19:15: passed as argument to `ASN1_OCTET_STRING_new`
  17.       ASN1_STRING *os;
  18.   
  19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                      ^
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:19:15: return from call to `ASN1_OCTET_STRING_new`
  17.       ASN1_STRING *os;
  18.   
  19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                      ^
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:19:10: assigned
  17.       ASN1_STRING *os;
  18.   
  19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                 ^
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:21:10: passed as argument to `ASN1_OCTET_STRING_set`
  19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {
                 ^
  22.           ASN1_OCTET_STRING_free(os);
  23.           return 0;

crypto/asn1/a_octet.c:25:1: parameter `x` of ASN1_OCTET_STRING_set
    23.   }
    24.   
    25. > int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d,
    26.                             int len)
    27.   {

crypto/asn1/a_octet.c:28:12: passed as argument to `ASN1_STRING_set`
    26.                             int len)
    27.   {
    28.       return ASN1_STRING_set(x, d, len);
                     ^
    29.   }

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
      269.   }
      270.   
      271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
      272.   {
      273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
      281.       }
      282.       if ((str->length <= len) || (str->data == NULL)) {
      283.           c = str->data;
                     ^
      284.           str->data = OPENSSL_realloc(c, len + 1);
      285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:287:13: assigned
      285.           if (str->data == NULL) {
      286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
      287.               str->data = c;
                         ^
      288.               return 0;
      289.           }

crypto/asn1/a_octet.c:28:12: return from call to `ASN1_STRING_set`
    26.                             int len)
    27.   {
    28.       return ASN1_STRING_set(x, d, len);
                     ^
    29.   }

crypto/asn1/evp_asn1.c:21:10: return from call to `ASN1_OCTET_STRING_set`
  19.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {
                 ^
  22.           ASN1_OCTET_STRING_free(os);
  23.           return 0;

crypto/asn1/evp_asn1.c:22:9: when calling `ASN1_OCTET_STRING_free` here
  20.           return 0;
  21.       if (!ASN1_OCTET_STRING_set(os, data, len)) {
  22.           ASN1_OCTET_STRING_free(os);
                ^
  23.           return 0;
  24.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }
