crypto/x509v3/v3_sxnet.c:125: error: USE_AFTER_FREE
  call to `ASN1_INTEGER_free()` eventually accesses memory that was invalidated by call to `free()` on line 123 indirectly during the call to `ASN1_INTEGER_set()`.
Showing all 39 steps of the trace


crypto/x509v3/v3_sxnet.c:122:18: invalidation part of the trace starts here
120.       ASN1_INTEGER *izone;
121.   
122.       if ((izone = ASN1_INTEGER_new()) == NULL
                        ^
123.           || !ASN1_INTEGER_set(izone, lzone)) {
124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_sxnet.c:122:18: passed as argument to `ASN1_INTEGER_new`
  120.       ASN1_INTEGER *izone;
  121.   
  122.       if ((izone = ASN1_INTEGER_new()) == NULL
                          ^
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_sxnet.c:122:18: return from call to `ASN1_INTEGER_new`
  120.       ASN1_INTEGER *izone;
  121.   
  122.       if ((izone = ASN1_INTEGER_new()) == NULL
                          ^
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_sxnet.c:122:10: assigned
  120.       ASN1_INTEGER *izone;
  121.   
  122.       if ((izone = ASN1_INTEGER_new()) == NULL
                  ^
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_sxnet.c:123:13: when calling `ASN1_INTEGER_set` here
  121.   
  122.       if ((izone = ASN1_INTEGER_new()) == NULL
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
                     ^
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);
  125.           ASN1_INTEGER_free(izone);

crypto/asn1/a_int.c:533:1: parameter `a` of ASN1_INTEGER_set
    531.   }
    532.   
    533. > int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);

crypto/asn1/a_int.c:535:12: when calling `ASN1_INTEGER_set_int64` here
    533.   int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);
                      ^
    536.   }
    537.   

crypto/asn1/a_int.c:518:1: parameter `a` of ASN1_INTEGER_set_int64
      516.   }
      517.   
      518. > int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);

crypto/asn1/a_int.c:520:12: when calling `asn1_string_set_int64` here
      518.   int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);
                        ^
      521.   }
      522.   

crypto/asn1/a_int.c:332:1: parameter `a` of asn1_string_set_int64
        330.   }
        331.   
        332. > static int asn1_string_set_int64(ASN1_STRING *a, int64_t r, int itype)
        333.   {
        334.       unsigned char tbuf[sizeof(r)];

crypto/asn1/a_int.c:350:12: when calling `ASN1_STRING_set` here
        348.           a->type &= ~V_ASN1_NEG;
        349.       }
        350.       return ASN1_STRING_set(a, tbuf + off, sizeof(tbuf) - off);
                          ^
        351.   }
        352.   

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
          269.   }
          270.   
          271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
          272.   {
          273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
          281.       }
          282.       if ((str->length <= len) || (str->data == NULL)) {
          283.           c = str->data;
                         ^
          284.           str->data = OPENSSL_realloc(c, len + 1);
          285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:284:21: when calling `CRYPTO_realloc` here
          282.       if ((str->length <= len) || (str->data == NULL)) {
          283.           c = str->data;
          284.           str->data = OPENSSL_realloc(c, len + 1);
                                     ^
          285.           if (str->data == NULL) {
          286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
            236.   }
            237.   
            238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            239.   {
            240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
            247.   
            248.       if (num == 0) {
            249.           CRYPTO_free(str, file, line);
                           ^
            250.           return NULL;
            251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
              293.   }
              294.   
              295. > void CRYPTO_free(void *str, const char *file, int line)
              296.   {
              297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
              310.       }
              311.   #else
              312.       free(str);
                         ^
              313.   #endif
              314.   }

crypto/x509v3/v3_sxnet.c:122:18: use-after-lifetime part of the trace starts here
120.       ASN1_INTEGER *izone;
121.   
122.       if ((izone = ASN1_INTEGER_new()) == NULL
                        ^
123.           || !ASN1_INTEGER_set(izone, lzone)) {
124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_sxnet.c:122:18: passed as argument to `ASN1_INTEGER_new`
  120.       ASN1_INTEGER *izone;
  121.   
  122.       if ((izone = ASN1_INTEGER_new()) == NULL
                          ^
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_sxnet.c:122:18: return from call to `ASN1_INTEGER_new`
  120.       ASN1_INTEGER *izone;
  121.   
  122.       if ((izone = ASN1_INTEGER_new()) == NULL
                          ^
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_sxnet.c:122:10: assigned
  120.       ASN1_INTEGER *izone;
  121.   
  122.       if ((izone = ASN1_INTEGER_new()) == NULL
                  ^
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_sxnet.c:123:13: passed as argument to `ASN1_INTEGER_set`
  121.   
  122.       if ((izone = ASN1_INTEGER_new()) == NULL
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
                     ^
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);
  125.           ASN1_INTEGER_free(izone);

crypto/asn1/a_int.c:533:1: parameter `a` of ASN1_INTEGER_set
    531.   }
    532.   
    533. > int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);

crypto/asn1/a_int.c:535:12: passed as argument to `ASN1_INTEGER_set_int64`
    533.   int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);
                      ^
    536.   }
    537.   

crypto/asn1/a_int.c:518:1: parameter `a` of ASN1_INTEGER_set_int64
      516.   }
      517.   
      518. > int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);

crypto/asn1/a_int.c:520:12: passed as argument to `asn1_string_set_int64`
      518.   int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);
                        ^
      521.   }
      522.   

crypto/asn1/a_int.c:332:1: parameter `a` of asn1_string_set_int64
        330.   }
        331.   
        332. > static int asn1_string_set_int64(ASN1_STRING *a, int64_t r, int itype)
        333.   {
        334.       unsigned char tbuf[sizeof(r)];

crypto/asn1/a_int.c:350:12: passed as argument to `ASN1_STRING_set`
        348.           a->type &= ~V_ASN1_NEG;
        349.       }
        350.       return ASN1_STRING_set(a, tbuf + off, sizeof(tbuf) - off);
                          ^
        351.   }
        352.   

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
          269.   }
          270.   
          271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
          272.   {
          273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
          281.       }
          282.       if ((str->length <= len) || (str->data == NULL)) {
          283.           c = str->data;
                         ^
          284.           str->data = OPENSSL_realloc(c, len + 1);
          285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:287:13: assigned
          285.           if (str->data == NULL) {
          286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
          287.               str->data = c;
                             ^
          288.               return 0;
          289.           }

crypto/asn1/a_int.c:350:12: return from call to `ASN1_STRING_set`
        348.           a->type &= ~V_ASN1_NEG;
        349.       }
        350.       return ASN1_STRING_set(a, tbuf + off, sizeof(tbuf) - off);
                          ^
        351.   }
        352.   

crypto/asn1/a_int.c:520:12: return from call to `asn1_string_set_int64`
      518.   int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r)
      519.   {
      520.       return asn1_string_set_int64(a, r, V_ASN1_INTEGER);
                        ^
      521.   }
      522.   

crypto/asn1/a_int.c:535:12: return from call to `ASN1_INTEGER_set_int64`
    533.   int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
    534.   {
    535.       return ASN1_INTEGER_set_int64(a, v);
                      ^
    536.   }
    537.   

crypto/x509v3/v3_sxnet.c:123:13: return from call to `ASN1_INTEGER_set`
  121.   
  122.       if ((izone = ASN1_INTEGER_new()) == NULL
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
                     ^
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);
  125.           ASN1_INTEGER_free(izone);

crypto/x509v3/v3_sxnet.c:125:9: when calling `ASN1_INTEGER_free` here
  123.           || !ASN1_INTEGER_set(izone, lzone)) {
  124.           X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);
  125.           ASN1_INTEGER_free(izone);
                 ^
  126.           return 0;
  127.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }
