crypto/x509v3/v3_info.c:156: error: USE_AFTER_FREE
  call to `sk_ACCESS_DESCRIPTION_pop_free()` eventually accesses memory that was invalidated by call to `free()` on line 117 indirectly during the call to `sk_ACCESS_DESCRIPTION_reserve()`.
Showing all 22 steps of the trace


crypto/x509v3/v3_info.c:113:18: invalidation part of the trace starts here
111.       char *objtmp, *ptmp;
112.   
113.       if ((ainfo = sk_ACCESS_DESCRIPTION_new_null()) == NULL) {
                        ^
114.           X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS, ERR_R_MALLOC_FAILURE);
115.           return NULL;

crypto/x509v3/v3_info.c:113:18: passed as argument to `sk_ACCESS_DESCRIPTION_new_null`
  111.       char *objtmp, *ptmp;
  112.   
  113.       if ((ainfo = sk_ACCESS_DESCRIPTION_new_null()) == NULL) {
                          ^
  114.           X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS, ERR_R_MALLOC_FAILURE);
  115.           return NULL;

crypto/x509v3/v3_info.c:113:18: return from call to `sk_ACCESS_DESCRIPTION_new_null`
  111.       char *objtmp, *ptmp;
  112.   
  113.       if ((ainfo = sk_ACCESS_DESCRIPTION_new_null()) == NULL) {
                          ^
  114.           X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS, ERR_R_MALLOC_FAILURE);
  115.           return NULL;

crypto/x509v3/v3_info.c:113:10: assigned
  111.       char *objtmp, *ptmp;
  112.   
  113.       if ((ainfo = sk_ACCESS_DESCRIPTION_new_null()) == NULL) {
                  ^
  114.           X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS, ERR_R_MALLOC_FAILURE);
  115.           return NULL;

crypto/x509v3/v3_info.c:117:10: when calling `sk_ACCESS_DESCRIPTION_reserve` here
  115.           return NULL;
  116.       }
  117.       if (!sk_ACCESS_DESCRIPTION_reserve(ainfo, num))
                  ^
  118.           goto err;
  119.       for (i = 0; i < num; i++) {

include/openssl/x509v3.h:170:1: parameter `sk` of sk_ACCESS_DESCRIPTION_reserve
    168.   DEFINE_STACK_OF(GENERAL_NAMES)
    169.   
    170. > DEFINE_STACK_OF(ACCESS_DESCRIPTION)
    171.   
    172.   typedef struct DIST_POINT_NAME_st {

include/openssl/x509v3.h:170:1: when calling `OPENSSL_sk_reserve` here
    168.   DEFINE_STACK_OF(GENERAL_NAMES)
    169.   
    170. > DEFINE_STACK_OF(ACCESS_DESCRIPTION)
    171.   
    172.   typedef struct DIST_POINT_NAME_st {

crypto/stack/stack.c:190:1: parameter `st` of OPENSSL_sk_reserve
      188.   }
      189.   
      190. > int OPENSSL_sk_reserve(OPENSSL_STACK *st, int n)
      191.   {
      192.       if (st == NULL || st->num < 0)

crypto/stack/stack.c:197:12: when calling `sk_reserve` here
      195.       if (n < 0)
      196.           return 1;
      197.       return sk_reserve(st, n, 1);
                        ^
      198.   }
      199.   

crypto/stack/stack.c:157:1: parameter `st` of sk_reserve
        155.   }
        156.   
        157. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
        158.   {
        159.       const void **tmpdata;

crypto/stack/stack.c:181:15: when calling `CRYPTO_realloc` here
        179.       }
        180.   
        181.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                             ^
        182.       if (tmpdata == NULL)
        183.           return 0;

crypto/mem.c:208:1: parameter `str` of CRYPTO_realloc
          206.   }
          207.   
          208. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
          209.   {
          210.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:218:9: when calling `CRYPTO_free` here
          216.   
          217.       if (num == 0) {
          218.           CRYPTO_free(str, file, line);
                         ^
          219.           return NULL;
          220.       }

crypto/mem.c:265:1: parameter `str` of CRYPTO_free
            263.   }
            264.   
            265. > void CRYPTO_free(void *str, const char *file, int line)
            266.   {
            267.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:281:5: was invalidated by call to `free()`
            279.       }
            280.   #else
            281.       free(str);
                       ^
            282.   #endif
            283.   }

crypto/x509v3/v3_info.c:113:18: use-after-lifetime part of the trace starts here
111.       char *objtmp, *ptmp;
112.   
113.       if ((ainfo = sk_ACCESS_DESCRIPTION_new_null()) == NULL) {
                        ^
114.           X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS, ERR_R_MALLOC_FAILURE);
115.           return NULL;

crypto/x509v3/v3_info.c:113:18: passed as argument to `sk_ACCESS_DESCRIPTION_new_null`
  111.       char *objtmp, *ptmp;
  112.   
  113.       if ((ainfo = sk_ACCESS_DESCRIPTION_new_null()) == NULL) {
                          ^
  114.           X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS, ERR_R_MALLOC_FAILURE);
  115.           return NULL;

crypto/x509v3/v3_info.c:113:18: return from call to `sk_ACCESS_DESCRIPTION_new_null`
  111.       char *objtmp, *ptmp;
  112.   
  113.       if ((ainfo = sk_ACCESS_DESCRIPTION_new_null()) == NULL) {
                          ^
  114.           X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS, ERR_R_MALLOC_FAILURE);
  115.           return NULL;

crypto/x509v3/v3_info.c:113:10: assigned
  111.       char *objtmp, *ptmp;
  112.   
  113.       if ((ainfo = sk_ACCESS_DESCRIPTION_new_null()) == NULL) {
                  ^
  114.           X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS, ERR_R_MALLOC_FAILURE);
  115.           return NULL;

crypto/x509v3/v3_info.c:156:5: when calling `sk_ACCESS_DESCRIPTION_pop_free` here
  154.       return ainfo;
  155.    err:
  156.       sk_ACCESS_DESCRIPTION_pop_free(ainfo, ACCESS_DESCRIPTION_free);
             ^
  157.       return NULL;
  158.   }

crypto/mem.c:265:1: parameter `str` of CRYPTO_free
    263.   }
    264.   
    265. > void CRYPTO_free(void *str, const char *file, int line)
    266.   {
    267.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:281:5: invalid access occurs here
    279.       }
    280.   #else
    281.       free(str);
               ^
    282.   #endif
    283.   }
