apps/crl2p7.c:160: error: USE_AFTER_FREE
  call to `sk_OPENSSL_STRING_free()` eventually accesses memory that was invalidated by call to `free()` on line 88 indirectly during the call to `sk_OPENSSL_STRING_push()`.
Showing all 24 steps of the trace


apps/crl2p7.c:86:32: invalidation part of the trace starts here
84.           case OPT_CERTFILE:
85.               if ((certflst == NULL)
86.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                     ^
87.                   goto end;
88.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:86:32: passed as argument to `sk_OPENSSL_STRING_new_null`
  84.           case OPT_CERTFILE:
  85.               if ((certflst == NULL)
  86.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                       ^
  87.                   goto end;
  88.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:86:32: return from call to `sk_OPENSSL_STRING_new_null`
  84.           case OPT_CERTFILE:
  85.               if ((certflst == NULL)
  86.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                       ^
  87.                   goto end;
  88.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:86:21: assigned
  84.           case OPT_CERTFILE:
  85.               if ((certflst == NULL)
  86.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                            ^
  87.                   goto end;
  88.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:88:18: when calling `sk_OPENSSL_STRING_push` here
  86.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
  87.                   goto end;
  88.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))
                         ^
  89.                   goto end;
  90.               break;

include/openssl/safestack.h:159:1: parameter `sk` of sk_OPENSSL_STRING_push
    157.    * dealt with in the autogenerated macros below.
    158.    */
    159. > DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char)
    160.   DEFINE_SPECIAL_STACK_OF_CONST(OPENSSL_CSTRING, char)
    161.   

include/openssl/safestack.h:159:1: when calling `OPENSSL_sk_push` here
    157.    * dealt with in the autogenerated macros below.
    158.    */
    159. > DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char)
    160.   DEFINE_SPECIAL_STACK_OF_CONST(OPENSSL_CSTRING, char)
    161.   

crypto/stack/stack.c:323:1: parameter `st` of OPENSSL_sk_push
      321.   }
      322.   
      323. > int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)
      324.   {
      325.       return OPENSSL_sk_insert(st, data, st->num);

crypto/stack/stack.c:325:12: when calling `OPENSSL_sk_insert` here
      323.   int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)
      324.   {
      325.       return OPENSSL_sk_insert(st, data, st->num);
                        ^
      326.   }
      327.   

crypto/stack/stack.c:234:1: parameter `st` of OPENSSL_sk_insert
        232.   }
        233.   
        234. > int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)
        235.   {
        236.       if (st->num == max_nodes)

crypto/stack/stack.c:239:10: when calling `sk_reserve` here
        237.           return 0;
        238.   
        239.       if (!sk_reserve(st, 1, 0))
                        ^
        240.           return 0;
        241.   

crypto/stack/stack.c:160:1: parameter `st` of sk_reserve
          158.   
          159.   /* internal STACK storage allocation */
          160. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
          161.   {
          162.       const void **tmpdata;

crypto/stack/stack.c:198:15: when calling `CRYPTO_realloc` here
          196.       }
          197.   
          198.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                               ^
          199.       if (tmpdata == NULL)
          200.           return 0;

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
            236.   }
            237.   
            238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            239.   {
            240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
            247.   
            248.       if (num == 0) {
            249.           CRYPTO_free(str, file, line);
                           ^
            250.           return NULL;
            251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
              293.   }
              294.   
              295. > void CRYPTO_free(void *str, const char *file, int line)
              296.   {
              297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
              310.       }
              311.   #else
              312.       free(str);
                         ^
              313.   #endif
              314.   }

apps/crl2p7.c:86:32: use-after-lifetime part of the trace starts here
84.           case OPT_CERTFILE:
85.               if ((certflst == NULL)
86.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                     ^
87.                   goto end;
88.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:86:32: passed as argument to `sk_OPENSSL_STRING_new_null`
  84.           case OPT_CERTFILE:
  85.               if ((certflst == NULL)
  86.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                       ^
  87.                   goto end;
  88.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:86:32: return from call to `sk_OPENSSL_STRING_new_null`
  84.           case OPT_CERTFILE:
  85.               if ((certflst == NULL)
  86.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                                       ^
  87.                   goto end;
  88.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:86:21: assigned
  84.           case OPT_CERTFILE:
  85.               if ((certflst == NULL)
  86.                   && (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
                            ^
  87.                   goto end;
  88.               if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))

apps/crl2p7.c:160:5: when calling `sk_OPENSSL_STRING_free` here
  158.       ret = 0;
  159.    end:
  160.       sk_OPENSSL_STRING_free(certflst);
             ^
  161.       BIO_free(in);
  162.       BIO_free_all(out);

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }
