crypto/x509v3/v3_pci.c:145: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 131 indirectly during the call to `CRYPTO_realloc()`.
Showing all 16 steps of the trace


crypto/x509v3/v3_pci.c:112:23: invalidation part of the trace starts here
110.           long val_len;
111.           if (!*policy) {
112.               *policy = ASN1_OCTET_STRING_new();
                             ^
113.               if (*policy == NULL) {
114.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:112:23: passed as argument to `ASN1_OCTET_STRING_new`
  110.           long val_len;
  111.           if (!*policy) {
  112.               *policy = ASN1_OCTET_STRING_new();
                               ^
  113.               if (*policy == NULL) {
  114.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:112:23: return from call to `ASN1_OCTET_STRING_new`
  110.           long val_len;
  111.           if (!*policy) {
  112.               *policy = ASN1_OCTET_STRING_new();
                               ^
  113.               if (*policy == NULL) {
  114.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:112:13: assigned
  110.           long val_len;
  111.           if (!*policy) {
  112.               *policy = ASN1_OCTET_STRING_new();
                     ^
  113.               if (*policy == NULL) {
  114.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:131:24: when calling `CRYPTO_realloc` here
  129.               }
  130.   
  131.               tmp_data = OPENSSL_realloc((*policy)->data,
                                ^
  132.                                          (*policy)->length + val_len + 1);
  133.               if (tmp_data) {

crypto/mem.c:165:1: parameter `str` of CRYPTO_realloc
    163.   }
    164.   
    165. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    166.   {
    167.       if (str == NULL)

crypto/mem.c:171:9: when calling `CRYPTO_free` here
    169.   
    170.       if (num == 0) {
    171.           CRYPTO_free(str);
                   ^
    172.           return NULL;
    173.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }

crypto/x509v3/v3_pci.c:112:23: use-after-lifetime part of the trace starts here
110.           long val_len;
111.           if (!*policy) {
112.               *policy = ASN1_OCTET_STRING_new();
                             ^
113.               if (*policy == NULL) {
114.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:112:23: passed as argument to `ASN1_OCTET_STRING_new`
  110.           long val_len;
  111.           if (!*policy) {
  112.               *policy = ASN1_OCTET_STRING_new();
                               ^
  113.               if (*policy == NULL) {
  114.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:112:23: return from call to `ASN1_OCTET_STRING_new`
  110.           long val_len;
  111.           if (!*policy) {
  112.               *policy = ASN1_OCTET_STRING_new();
                               ^
  113.               if (*policy == NULL) {
  114.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:112:13: assigned
  110.           long val_len;
  111.           if (!*policy) {
  112.               *policy = ASN1_OCTET_STRING_new();
                     ^
  113.               if (*policy == NULL) {
  114.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:145:17: when calling `CRYPTO_free` here
  143.                    * too!
  144.                    */
  145.                   OPENSSL_free((*policy)->data);
                         ^
  146.                   (*policy)->data = NULL;
  147.                   (*policy)->length = 0;

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }
