test/ssltest_old.c:2882: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 2881 indirectly during the call to `CRYPTO_free()`.
Showing all 18 steps of the trace


test/ssltest_old.c:2626:14: invalidation part of the trace starts here
2624.       int err_in_server = 0;
2625.   
2626.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2627.   
2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2626:14: assigned
  2624.       int err_in_server = 0;
  2625.   
  2626.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2627.   
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2626:5: assigned
  2624.       int err_in_server = 0;
  2625.   
  2626.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2627.   
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2628:17: passed as argument to `CRYPTO_zalloc`
  2626.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2627.   
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2629.           goto err;
  2630.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2628:17: return from call to `CRYPTO_zalloc`
  2626.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2627.   
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2629.           goto err;
  2630.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2628:10: assigned
  2626.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2627.   
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2629.           goto err;
  2630.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2881:5: when calling `CRYPTO_free` here
  2879.       BIO_free_all(c_bio);
  2880.       BIO_free_all(s_bio);
  2881.       OPENSSL_free(cbuf);
              ^
  2882.       OPENSSL_free(sbuf);
  2883.   

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
    251.   }
    252.   
    253. > void CRYPTO_free(void *str, const char *file, int line)
    254.   {
    255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: was invalidated by call to `free()`
    267.       }
    268.   #else
    269.       free(str);
               ^
    270.   #endif
    271.   }

test/ssltest_old.c:2626:14: use-after-lifetime part of the trace starts here
2624.       int err_in_server = 0;
2625.   
2626.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2627.   
2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2626:14: assigned
  2624.       int err_in_server = 0;
  2625.   
  2626.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2627.   
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2626:5: assigned
  2624.       int err_in_server = 0;
  2625.   
  2626.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2627.   
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2630:17: passed as argument to `CRYPTO_zalloc`
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2629.           goto err;
  2630.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2631.           goto err;
  2632.   

test/ssltest_old.c:2630:17: return from call to `CRYPTO_zalloc`
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2629.           goto err;
  2630.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2631.           goto err;
  2632.   

test/ssltest_old.c:2630:10: assigned
  2628.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2629.           goto err;
  2630.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2631.           goto err;
  2632.   

test/ssltest_old.c:2882:5: when calling `CRYPTO_free` here
  2880.       BIO_free_all(s_bio);
  2881.       OPENSSL_free(cbuf);
  2882.       OPENSSL_free(sbuf);
              ^
  2883.   
  2884.       if (should_negotiate != NULL && strcmp(should_negotiate, "fail-client") == 0)

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
    251.   }
    252.   
    253. > void CRYPTO_free(void *str, const char *file, int line)
    254.   {
    255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: invalid access occurs here
    267.       }
    268.   #else
    269.       free(str);
               ^
    270.   #endif
    271.   }
