crypto/asn1/asn1_lib.c:301: error: USE_AFTER_FREE
  call to `ASN1_STRING_free()` eventually accesses memory that was invalidated by call to `free()` on line 300 indirectly during the call to `ASN1_STRING_copy()`.
Showing all 31 steps of the trace


crypto/asn1/asn1_lib.c:297:11: invalidation part of the trace starts here
295.       if (!str)
296.           return NULL;
297.       ret = ASN1_STRING_new();
                 ^
298.       if (ret == NULL)
299.           return NULL;

crypto/asn1/asn1_lib.c:297:11: passed as argument to `ASN1_STRING_new`
  295.       if (!str)
  296.           return NULL;
  297.       ret = ASN1_STRING_new();
                   ^
  298.       if (ret == NULL)
  299.           return NULL;

crypto/asn1/asn1_lib.c:297:11: return from call to `ASN1_STRING_new`
  295.       if (!str)
  296.           return NULL;
  297.       ret = ASN1_STRING_new();
                   ^
  298.       if (ret == NULL)
  299.           return NULL;

crypto/asn1/asn1_lib.c:297:5: assigned
  295.       if (!str)
  296.           return NULL;
  297.       ret = ASN1_STRING_new();
             ^
  298.       if (ret == NULL)
  299.           return NULL;

crypto/asn1/asn1_lib.c:300:10: when calling `ASN1_STRING_copy` here
  298.       if (ret == NULL)
  299.           return NULL;
  300.       if (!ASN1_STRING_copy(ret, str)) {
                  ^
  301.           ASN1_STRING_free(ret);
  302.           return NULL;

crypto/asn1/asn1_lib.c:279:1: parameter `dst` of ASN1_STRING_copy
    277.   }
    278.   
    279. > int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str)
    280.   {
    281.       if (str == NULL)

crypto/asn1/asn1_lib.c:284:10: when calling `ASN1_STRING_set` here
    282.           return 0;
    283.       dst->type = str->type;
    284.       if (!ASN1_STRING_set(dst, str->data, str->length))
                    ^
    285.           return 0;
    286.       /* Copy flags but preserve embed value */

crypto/asn1/asn1_lib.c:307:1: parameter `str` of ASN1_STRING_set
      305.   }
      306.   
      307. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
      308.   {
      309.       unsigned char *c;

crypto/asn1/asn1_lib.c:319:9: assigned
      317.       }
      318.       if ((str->length < len) || (str->data == NULL)) {
      319.           c = str->data;
                     ^
      320.           str->data = OPENSSL_realloc(c, len + 1);
      321.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:320:21: when calling `CRYPTO_realloc` here
      318.       if ((str->length < len) || (str->data == NULL)) {
      319.           c = str->data;
      320.           str->data = OPENSSL_realloc(c, len + 1);
                                 ^
      321.           if (str->data == NULL) {
      322.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:165:1: parameter `str` of CRYPTO_realloc
        163.   }
        164.   
        165. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
        166.   {
        167.       if (str == NULL)

crypto/mem.c:171:9: when calling `CRYPTO_free` here
        169.   
        170.       if (num == 0) {
        171.           CRYPTO_free(str);
                       ^
        172.           return NULL;
        173.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
          231.   }
          232.   
          233. > void CRYPTO_free(void *str)
          234.   {
          235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
          242.       }
          243.   #else
          244.       free(str);
                     ^
          245.   #endif
          246.   }

crypto/asn1/asn1_lib.c:297:11: use-after-lifetime part of the trace starts here
295.       if (!str)
296.           return NULL;
297.       ret = ASN1_STRING_new();
                 ^
298.       if (ret == NULL)
299.           return NULL;

crypto/asn1/asn1_lib.c:297:11: passed as argument to `ASN1_STRING_new`
  295.       if (!str)
  296.           return NULL;
  297.       ret = ASN1_STRING_new();
                   ^
  298.       if (ret == NULL)
  299.           return NULL;

crypto/asn1/asn1_lib.c:297:11: return from call to `ASN1_STRING_new`
  295.       if (!str)
  296.           return NULL;
  297.       ret = ASN1_STRING_new();
                   ^
  298.       if (ret == NULL)
  299.           return NULL;

crypto/asn1/asn1_lib.c:297:5: assigned
  295.       if (!str)
  296.           return NULL;
  297.       ret = ASN1_STRING_new();
             ^
  298.       if (ret == NULL)
  299.           return NULL;

crypto/asn1/asn1_lib.c:300:10: passed as argument to `ASN1_STRING_copy`
  298.       if (ret == NULL)
  299.           return NULL;
  300.       if (!ASN1_STRING_copy(ret, str)) {
                  ^
  301.           ASN1_STRING_free(ret);
  302.           return NULL;

crypto/asn1/asn1_lib.c:279:1: parameter `dst` of ASN1_STRING_copy
    277.   }
    278.   
    279. > int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str)
    280.   {
    281.       if (str == NULL)

crypto/asn1/asn1_lib.c:284:10: passed as argument to `ASN1_STRING_set`
    282.           return 0;
    283.       dst->type = str->type;
    284.       if (!ASN1_STRING_set(dst, str->data, str->length))
                    ^
    285.           return 0;
    286.       /* Copy flags but preserve embed value */

crypto/asn1/asn1_lib.c:307:1: parameter `str` of ASN1_STRING_set
      305.   }
      306.   
      307. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
      308.   {
      309.       unsigned char *c;

crypto/asn1/asn1_lib.c:319:9: assigned
      317.       }
      318.       if ((str->length < len) || (str->data == NULL)) {
      319.           c = str->data;
                     ^
      320.           str->data = OPENSSL_realloc(c, len + 1);
      321.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:323:13: assigned
      321.           if (str->data == NULL) {
      322.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
      323.               str->data = c;
                         ^
      324.               return (0);
      325.           }

crypto/asn1/asn1_lib.c:284:10: return from call to `ASN1_STRING_set`
    282.           return 0;
    283.       dst->type = str->type;
    284.       if (!ASN1_STRING_set(dst, str->data, str->length))
                    ^
    285.           return 0;
    286.       /* Copy flags but preserve embed value */

crypto/asn1/asn1_lib.c:300:10: return from call to `ASN1_STRING_copy`
  298.       if (ret == NULL)
  299.           return NULL;
  300.       if (!ASN1_STRING_copy(ret, str)) {
                  ^
  301.           ASN1_STRING_free(ret);
  302.           return NULL;

crypto/asn1/asn1_lib.c:301:9: when calling `ASN1_STRING_free` here
  299.           return NULL;
  300.       if (!ASN1_STRING_copy(ret, str)) {
  301.           ASN1_STRING_free(ret);
                 ^
  302.           return NULL;
  303.       }

crypto/asn1/asn1_lib.c:361:1: parameter `a` of ASN1_STRING_free
    359.   }
    360.   
    361. > void ASN1_STRING_free(ASN1_STRING *a)
    362.   {
    363.       if (a == NULL)

crypto/asn1/asn1_lib.c:366:9: when calling `CRYPTO_free` here
    364.           return;
    365.       if (!(a->flags & ASN1_STRING_FLAG_NDEF))
    366.           OPENSSL_free(a->data);
                   ^
    367.       if (!(a->flags & ASN1_STRING_FLAG_EMBED))
    368.           OPENSSL_free(a);

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }
