crypto/async/async.c:293: error: USE_AFTER_FREE
  call to `async_job_free()` eventually accesses memory that was invalidated by call to `free()` on line 293 indirectly during the call to `async_job_free()`.
Showing all 40 steps of the trace


crypto/async/async.c:284:1: invalidation part of the trace starts here
282.   }
283.   
284. > static void async_empty_pool(async_pool *pool)
285.   {
286.       ASYNC_JOB *job;

crypto/async/async.c:284:1: parameter `pool` of async_empty_pool
  282.   }
  283.   
  284. > static void async_empty_pool(async_pool *pool)
  285.   {
  286.       ASYNC_JOB *job;

crypto/async/async.c:292:15: passed as argument to `sk_ASYNC_JOB_pop`
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async_locl.h:64:1: parameter `sk` of sk_ASYNC_JOB_pop
    62.   };
    63.   
    64. > DEFINE_STACK_OF(ASYNC_JOB)
    65.   
    66.   struct async_pool_st {

crypto/async/async_locl.h:64:1: passed as argument to `OPENSSL_sk_pop`
    62.   };
    63.   
    64. > DEFINE_STACK_OF(ASYNC_JOB)
    65.   
    66.   struct async_pool_st {

crypto/stack/stack.c:341:1: parameter `st` of OPENSSL_sk_pop
      339.   }
      340.   
      341. > void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      342.   {
      343.       if (st == NULL || st->num == 0)

crypto/stack/stack.c:345:12: passed as argument to `internal_delete`
      343.       if (st == NULL || st->num == 0)
      344.           return NULL;
      345.       return internal_delete(st, st->num - 1);
                        ^
      346.   }
      347.   

crypto/stack/stack.c:258:10: passed as argument to function `memmove` with no summary
        256.   
        257.       if (loc != st->num - 1)
        258.            memmove(&st->data[loc], &st->data[loc + 1],
                        ^
        259.                    sizeof(st->data[0]) * (st->num - loc - 1));
        260.       st->num--;

crypto/stack/stack.c:258:10: return from call to function `memmove` with no summary
        256.   
        257.       if (loc != st->num - 1)
        258.            memmove(&st->data[loc], &st->data[loc + 1],
                        ^
        259.                    sizeof(st->data[0]) * (st->num - loc - 1));
        260.       st->num--;

crypto/stack/stack.c:345:12: return from call to `internal_delete`
      343.       if (st == NULL || st->num == 0)
      344.           return NULL;
      345.       return internal_delete(st, st->num - 1);
                        ^
      346.   }
      347.   

crypto/async/async_locl.h:64:1: return from call to `OPENSSL_sk_pop`
    62.   };
    63.   
    64. > DEFINE_STACK_OF(ASYNC_JOB)
    65.   
    66.   struct async_pool_st {

crypto/async/async.c:292:15: return from call to `sk_ASYNC_JOB_pop`
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async.c:292:15: passed as argument to `sk_ASYNC_JOB_pop`
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async.c:292:15: return from call to `sk_ASYNC_JOB_pop`
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async.c:292:9: assigned
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                 ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async.c:293:9: when calling `async_job_free` here
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
  293.           async_job_free(job);
                 ^
  294.       } while (job);
  295.   }

crypto/async/async.c:93:1: parameter `job` of async_job_free
    91.   }
    92.   
    93. > static void async_job_free(ASYNC_JOB *job)
    94.   {
    95.       if (job != NULL) {

crypto/async/async.c:98:9: when calling `CRYPTO_free` here
    96.           OPENSSL_free(job->funcargs);
    97.           async_fibre_free(&job->fibrectx);
    98.           OPENSSL_free(job);
                   ^
    99.       }
    100.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
      310.       }
      311.   #else
      312.       free(str);
                 ^
      313.   #endif
      314.   }

crypto/async/async.c:284:1: use-after-lifetime part of the trace starts here
282.   }
283.   
284. > static void async_empty_pool(async_pool *pool)
285.   {
286.       ASYNC_JOB *job;

crypto/async/async.c:284:1: parameter `pool` of async_empty_pool
  282.   }
  283.   
  284. > static void async_empty_pool(async_pool *pool)
  285.   {
  286.       ASYNC_JOB *job;

crypto/async/async.c:292:15: passed as argument to `sk_ASYNC_JOB_pop`
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async_locl.h:64:1: parameter `sk` of sk_ASYNC_JOB_pop
    62.   };
    63.   
    64. > DEFINE_STACK_OF(ASYNC_JOB)
    65.   
    66.   struct async_pool_st {

crypto/async/async_locl.h:64:1: passed as argument to `OPENSSL_sk_pop`
    62.   };
    63.   
    64. > DEFINE_STACK_OF(ASYNC_JOB)
    65.   
    66.   struct async_pool_st {

crypto/stack/stack.c:341:1: parameter `st` of OPENSSL_sk_pop
      339.   }
      340.   
      341. > void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      342.   {
      343.       if (st == NULL || st->num == 0)

crypto/stack/stack.c:345:12: passed as argument to `internal_delete`
      343.       if (st == NULL || st->num == 0)
      344.           return NULL;
      345.       return internal_delete(st, st->num - 1);
                        ^
      346.   }
      347.   

crypto/stack/stack.c:258:10: passed as argument to function `memmove` with no summary
        256.   
        257.       if (loc != st->num - 1)
        258.            memmove(&st->data[loc], &st->data[loc + 1],
                        ^
        259.                    sizeof(st->data[0]) * (st->num - loc - 1));
        260.       st->num--;

crypto/stack/stack.c:258:10: return from call to function `memmove` with no summary
        256.   
        257.       if (loc != st->num - 1)
        258.            memmove(&st->data[loc], &st->data[loc + 1],
                        ^
        259.                    sizeof(st->data[0]) * (st->num - loc - 1));
        260.       st->num--;

crypto/stack/stack.c:345:12: return from call to `internal_delete`
      343.       if (st == NULL || st->num == 0)
      344.           return NULL;
      345.       return internal_delete(st, st->num - 1);
                        ^
      346.   }
      347.   

crypto/async/async_locl.h:64:1: return from call to `OPENSSL_sk_pop`
    62.   };
    63.   
    64. > DEFINE_STACK_OF(ASYNC_JOB)
    65.   
    66.   struct async_pool_st {

crypto/async/async.c:292:15: return from call to `sk_ASYNC_JOB_pop`
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async.c:292:15: passed as argument to `sk_ASYNC_JOB_pop`
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async.c:292:15: return from call to `sk_ASYNC_JOB_pop`
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async.c:292:9: assigned
  290.   
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
                 ^
  293.           async_job_free(job);
  294.       } while (job);

crypto/async/async.c:293:9: when calling `async_job_free` here
  291.       do {
  292.           job = sk_ASYNC_JOB_pop(pool->jobs);
  293.           async_job_free(job);
                 ^
  294.       } while (job);
  295.   }

crypto/async/async.c:93:1: parameter `job` of async_job_free
    91.   }
    92.   
    93. > static void async_job_free(ASYNC_JOB *job)
    94.   {
    95.       if (job != NULL) {

crypto/async/async.c:98:9: when calling `CRYPTO_free` here
    96.           OPENSSL_free(job->funcargs);
    97.           async_fibre_free(&job->fibrectx);
    98.           OPENSSL_free(job);
                   ^
    99.       }
    100.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
      310.       }
      311.   #else
      312.       free(str);
                 ^
      313.   #endif
      314.   }
