crypto/asn1/x_name.c:197: error: USE_AFTER_FREE
  call to `X509_NAME_ENTRY_free()` eventually accesses memory that was invalidated by call to `free()` on line 197 indirectly during the call to `X509_NAME_ENTRY_free()`.
Showing all 30 steps of the trace


crypto/asn1/x_name.c:186:1: invalidation part of the trace starts here
184.   	}
185.   
186. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
187.   	{
188.   	int set=0,i;

crypto/asn1/x_name.c:186:1: parameter `a` of d2i_X509_NAME
  184.   	}
  185.   
  186. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  187.   	{
  188.   	int set=0,i;

crypto/asn1/x_name.c:191:2: assigned
  189.   	int idx=0;
  190.   	unsigned char *orig;
  191.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  192.   
  193.   	orig= *pp;

crypto/asn1/x_name.c:198:5: passed as argument to `sk_pop`
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  198.   				sk_pop(ret->entries));
             ^
  199.   		}
  200.   

crypto/stack/stack.c:256:1: parameter `st` of sk_pop
    254.   	}
    255.   
    256. > char *sk_pop(STACK *st)
    257.   	{
    258.   	if (st == NULL) return(NULL);

crypto/stack/stack.c:260:9: passed as argument to `sk_delete`
    258.   	if (st == NULL) return(NULL);
    259.   	if (st->num <= 0) return(NULL);
    260.   	return(sk_delete(st,st->num-1));
                   ^
    261.   	}
    262.   

crypto/stack/stack.c:186:1: parameter `st` of sk_delete
      184.   	}
      185.   
      186. > char *sk_delete(STACK *st, int loc)
      187.   	{
      188.   	char *ret;

crypto/stack/stack.c:198:4: assigned
      196.   		j=st->num-1;
      197.   		for (i=loc; i<j; i++)
      198.   			st->data[i]=st->data[i+1];
                ^
      199.   		/* In theory memcpy is not safe for this
      200.   		 * memcpy( &(st->data[loc]),

crypto/stack/stack.c:260:9: return from call to `sk_delete`
    258.   	if (st == NULL) return(NULL);
    259.   	if (st->num <= 0) return(NULL);
    260.   	return(sk_delete(st,st->num-1));
                   ^
    261.   	}
    262.   

crypto/asn1/x_name.c:198:5: return from call to `sk_pop`
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  198.   				sk_pop(ret->entries));
             ^
  199.   		}
  200.   

crypto/asn1/x_name.c:198:5: passed as argument to `sk_pop`
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  198.   				sk_pop(ret->entries));
             ^
  199.   		}
  200.   

crypto/asn1/x_name.c:198:5: return from call to `sk_pop`
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  198.   				sk_pop(ret->entries));
             ^
  199.   		}
  200.   

crypto/asn1/x_name.c:197:4: when calling `X509_NAME_ENTRY_free` here
  195.   		{
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
            ^
  198.   				sk_pop(ret->entries));
  199.   		}

crypto/asn1/x_name.c:263:1: parameter `a` of X509_NAME_ENTRY_free
    261.   	}
    262.   
    263. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    264.   	{
    265.   	if (a == NULL) return;

crypto/asn1/x_name.c:268:2: was invalidated by call to `free()`
    266.   	ASN1_OBJECT_free(a->object);
    267.   	ASN1_BIT_STRING_free(a->value);
    268.   	Free((char *)a);
            ^
    269.   	}
    270.   

crypto/asn1/x_name.c:186:1: use-after-lifetime part of the trace starts here
184.   	}
185.   
186. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
187.   	{
188.   	int set=0,i;

crypto/asn1/x_name.c:186:1: parameter `a` of d2i_X509_NAME
  184.   	}
  185.   
  186. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  187.   	{
  188.   	int set=0,i;

crypto/asn1/x_name.c:191:2: assigned
  189.   	int idx=0;
  190.   	unsigned char *orig;
  191.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  192.   
  193.   	orig= *pp;

crypto/asn1/x_name.c:198:5: passed as argument to `sk_pop`
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  198.   				sk_pop(ret->entries));
             ^
  199.   		}
  200.   

crypto/stack/stack.c:256:1: parameter `st` of sk_pop
    254.   	}
    255.   
    256. > char *sk_pop(STACK *st)
    257.   	{
    258.   	if (st == NULL) return(NULL);

crypto/stack/stack.c:260:9: passed as argument to `sk_delete`
    258.   	if (st == NULL) return(NULL);
    259.   	if (st->num <= 0) return(NULL);
    260.   	return(sk_delete(st,st->num-1));
                   ^
    261.   	}
    262.   

crypto/stack/stack.c:186:1: parameter `st` of sk_delete
      184.   	}
      185.   
      186. > char *sk_delete(STACK *st, int loc)
      187.   	{
      188.   	char *ret;

crypto/stack/stack.c:198:4: assigned
      196.   		j=st->num-1;
      197.   		for (i=loc; i<j; i++)
      198.   			st->data[i]=st->data[i+1];
                ^
      199.   		/* In theory memcpy is not safe for this
      200.   		 * memcpy( &(st->data[loc]),

crypto/stack/stack.c:260:9: return from call to `sk_delete`
    258.   	if (st == NULL) return(NULL);
    259.   	if (st->num <= 0) return(NULL);
    260.   	return(sk_delete(st,st->num-1));
                   ^
    261.   	}
    262.   

crypto/asn1/x_name.c:198:5: return from call to `sk_pop`
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  198.   				sk_pop(ret->entries));
             ^
  199.   		}
  200.   

crypto/asn1/x_name.c:198:5: passed as argument to `sk_pop`
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  198.   				sk_pop(ret->entries));
             ^
  199.   		}
  200.   

crypto/asn1/x_name.c:198:5: return from call to `sk_pop`
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
  198.   				sk_pop(ret->entries));
             ^
  199.   		}
  200.   

crypto/asn1/x_name.c:197:4: when calling `X509_NAME_ENTRY_free` here
  195.   		{
  196.   		while (sk_num(ret->entries) > 0)
  197.   			X509_NAME_ENTRY_free((X509_NAME_ENTRY *)
            ^
  198.   				sk_pop(ret->entries));
  199.   		}

crypto/asn1/x_name.c:263:1: parameter `a` of X509_NAME_ENTRY_free
    261.   	}
    262.   
    263. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    264.   	{
    265.   	if (a == NULL) return;

crypto/asn1/x_name.c:268:2: invalid access occurs here
    266.   	ASN1_OBJECT_free(a->object);
    267.   	ASN1_BIT_STRING_free(a->value);
    268.   	Free((char *)a);
            ^
    269.   	}
    270.   
