crypto/x509v3/v3_ia5.c:105: error: USE_AFTER_FREE
  call to `ASN1_IA5STRING_free()` eventually accesses memory that was invalidated by call to `free()` on line 103 indirectly during the call to `ASN1_STRING_set()`.
Showing all 24 steps of the trace


crypto/x509v3/v3_ia5.c:101:16: invalidation part of the trace starts here
99.           return NULL;
100.       }
101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                      ^
102.           goto err;
103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,

crypto/x509v3/v3_ia5.c:101:16: passed as argument to `ASN1_IA5STRING_new`
  99.           return NULL;
  100.       }
  101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                        ^
  102.           goto err;
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,

crypto/x509v3/v3_ia5.c:101:16: return from call to `ASN1_IA5STRING_new`
  99.           return NULL;
  100.       }
  101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                        ^
  102.           goto err;
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,

crypto/x509v3/v3_ia5.c:101:10: assigned
  99.           return NULL;
  100.       }
  101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                  ^
  102.           goto err;
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,

crypto/x509v3/v3_ia5.c:103:10: when calling `ASN1_STRING_set` here
  101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
  102.           goto err;
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,
                  ^
  104.                            strlen(str))) {
  105.           ASN1_IA5STRING_free(ia5);

crypto/asn1/asn1_lib.c:307:1: parameter `str` of ASN1_STRING_set
    305.   }
    306.   
    307. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
    308.   {
    309.       unsigned char *c;

crypto/asn1/asn1_lib.c:319:9: assigned
    317.       }
    318.       if ((str->length < len) || (str->data == NULL)) {
    319.           c = str->data;
                   ^
    320.           str->data = OPENSSL_realloc(c, len + 1);
    321.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:320:21: when calling `CRYPTO_realloc` here
    318.       if ((str->length < len) || (str->data == NULL)) {
    319.           c = str->data;
    320.           str->data = OPENSSL_realloc(c, len + 1);
                               ^
    321.           if (str->data == NULL) {
    322.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:165:1: parameter `str` of CRYPTO_realloc
      163.   }
      164.   
      165. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      166.   {
      167.       if (str == NULL)

crypto/mem.c:171:9: when calling `CRYPTO_free` here
      169.   
      170.       if (num == 0) {
      171.           CRYPTO_free(str);
                     ^
      172.           return NULL;
      173.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
        231.   }
        232.   
        233. > void CRYPTO_free(void *str)
        234.   {
        235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
        242.       }
        243.   #else
        244.       free(str);
                   ^
        245.   #endif
        246.   }

crypto/x509v3/v3_ia5.c:101:16: use-after-lifetime part of the trace starts here
99.           return NULL;
100.       }
101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                      ^
102.           goto err;
103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,

crypto/x509v3/v3_ia5.c:101:16: passed as argument to `ASN1_IA5STRING_new`
  99.           return NULL;
  100.       }
  101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                        ^
  102.           goto err;
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,

crypto/x509v3/v3_ia5.c:101:16: return from call to `ASN1_IA5STRING_new`
  99.           return NULL;
  100.       }
  101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                        ^
  102.           goto err;
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,

crypto/x509v3/v3_ia5.c:101:10: assigned
  99.           return NULL;
  100.       }
  101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                  ^
  102.           goto err;
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,

crypto/x509v3/v3_ia5.c:103:10: passed as argument to `ASN1_STRING_set`
  101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
  102.           goto err;
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,
                  ^
  104.                            strlen(str))) {
  105.           ASN1_IA5STRING_free(ia5);

crypto/asn1/asn1_lib.c:307:1: parameter `str` of ASN1_STRING_set
    305.   }
    306.   
    307. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
    308.   {
    309.       unsigned char *c;

crypto/asn1/asn1_lib.c:319:9: assigned
    317.       }
    318.       if ((str->length < len) || (str->data == NULL)) {
    319.           c = str->data;
                   ^
    320.           str->data = OPENSSL_realloc(c, len + 1);
    321.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:323:13: assigned
    321.           if (str->data == NULL) {
    322.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
    323.               str->data = c;
                       ^
    324.               return (0);
    325.           }

crypto/x509v3/v3_ia5.c:103:10: return from call to `ASN1_STRING_set`
  101.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
  102.           goto err;
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,
                  ^
  104.                            strlen(str))) {
  105.           ASN1_IA5STRING_free(ia5);

crypto/x509v3/v3_ia5.c:105:9: when calling `ASN1_IA5STRING_free` here
  103.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char *)str,
  104.                            strlen(str))) {
  105.           ASN1_IA5STRING_free(ia5);
                 ^
  106.           goto err;
  107.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }
