crypto/asn1/x_name.c:186: error: USE_AFTER_FREE
  call to `X509_NAME_ENTRY_free()` eventually accesses memory that was invalidated by call to `free()` on line 186 indirectly during the call to `X509_NAME_ENTRY_free()`.
Showing all 16 steps of the trace


crypto/asn1/x_name.c:175:1: invalidation part of the trace starts here
173.   	}
174.   
175. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
176.   	{
177.   	int set=0,i;

crypto/asn1/x_name.c:175:1: parameter `a` of d2i_X509_NAME
  173.   	}
  174.   
  175. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  176.   	{
  177.   	int set=0,i;

crypto/asn1/x_name.c:180:2: assigned
  178.   	int idx=0;
  179.   	unsigned char *orig;
  180.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  181.   
  182.   	orig= *pp;

crypto/asn1/x_name.c:187:12: passed as argument to `sk_X509_NAME_ENTRY_pop`
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  188.   		}
  189.   

crypto/asn1/x_name.c:187:12: return from call to `sk_X509_NAME_ENTRY_pop`
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  188.   		}
  189.   

crypto/asn1/x_name.c:186:4: when calling `X509_NAME_ENTRY_free` here
  184.   		{
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
            ^
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
  188.   		}

crypto/asn1/x_name.c:252:1: parameter `a` of X509_NAME_ENTRY_free
    250.   	}
    251.   
    252. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    253.   	{
    254.   	if (a == NULL) return;

crypto/asn1/x_name.c:257:2: was invalidated by call to `free()`
    255.   	ASN1_OBJECT_free(a->object);
    256.   	M_ASN1_BIT_STRING_free(a->value);
    257.   	Free(a);
            ^
    258.   	}
    259.   

crypto/asn1/x_name.c:175:1: use-after-lifetime part of the trace starts here
173.   	}
174.   
175. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
176.   	{
177.   	int set=0,i;

crypto/asn1/x_name.c:175:1: parameter `a` of d2i_X509_NAME
  173.   	}
  174.   
  175. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  176.   	{
  177.   	int set=0,i;

crypto/asn1/x_name.c:180:2: assigned
  178.   	int idx=0;
  179.   	unsigned char *orig;
  180.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  181.   
  182.   	orig= *pp;

crypto/asn1/x_name.c:187:12: passed as argument to `sk_X509_NAME_ENTRY_pop`
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  188.   		}
  189.   

crypto/asn1/x_name.c:187:12: return from call to `sk_X509_NAME_ENTRY_pop`
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  188.   		}
  189.   

crypto/asn1/x_name.c:186:4: when calling `X509_NAME_ENTRY_free` here
  184.   		{
  185.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  186.   			X509_NAME_ENTRY_free(
            ^
  187.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
  188.   		}

crypto/asn1/x_name.c:252:1: parameter `a` of X509_NAME_ENTRY_free
    250.   	}
    251.   
    252. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    253.   	{
    254.   	if (a == NULL) return;

crypto/asn1/x_name.c:257:2: invalid access occurs here
    255.   	ASN1_OBJECT_free(a->object);
    256.   	M_ASN1_BIT_STRING_free(a->value);
    257.   	Free(a);
            ^
    258.   	}
    259.   
