crypto/stack/stack.c:216: error: USE_AFTER_FREE
  call to `OPENSSL_sk_free()` eventually accesses memory that was invalidated by call to `free()` on line 215 indirectly during the call to `sk_reserve()`.
Showing all 20 steps of the trace


crypto/stack/stack.c:205:25: invalidation part of the trace starts here
203.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
204.   {
205.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                               ^
206.   
207.       if (st == NULL)

crypto/stack/stack.c:205:25: passed as argument to `CRYPTO_zalloc`
  203.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  204.   {
  205.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  206.   
  207.       if (st == NULL)

crypto/stack/stack.c:205:25: return from call to `CRYPTO_zalloc`
  203.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  204.   {
  205.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  206.   
  207.       if (st == NULL)

crypto/stack/stack.c:205:5: assigned
  203.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  204.   {
  205.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
             ^
  206.   
  207.       if (st == NULL)

crypto/stack/stack.c:215:10: when calling `sk_reserve` here
  213.           return st;
  214.   
  215.       if (!sk_reserve(st, n, 1)) {
                  ^
  216.           OPENSSL_sk_free(st);
  217.           return NULL;

crypto/stack/stack.c:156:1: parameter `st` of sk_reserve
    154.   
    155.   /* internal STACK storage allocation */
    156. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
    157.   {
    158.       const void **tmpdata;

crypto/stack/stack.c:194:15: when calling `CRYPTO_realloc` here
    192.       }
    193.   
    194.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                         ^
    195.       if (tmpdata == NULL)
    196.           return 0;

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
      236.   }
      237.   
      238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      239.   {
      240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
      247.   
      248.       if (num == 0) {
      249.           CRYPTO_free(str, file, line);
                     ^
      250.           return NULL;
      251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
        293.   }
        294.   
        295. > void CRYPTO_free(void *str, const char *file, int line)
        296.   {
        297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
        310.       }
        311.   #else
        312.       free(str);
                   ^
        313.   #endif
        314.   }

crypto/stack/stack.c:205:25: use-after-lifetime part of the trace starts here
203.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
204.   {
205.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                               ^
206.   
207.       if (st == NULL)

crypto/stack/stack.c:205:25: passed as argument to `CRYPTO_zalloc`
  203.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  204.   {
  205.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  206.   
  207.       if (st == NULL)

crypto/stack/stack.c:205:25: return from call to `CRYPTO_zalloc`
  203.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  204.   {
  205.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  206.   
  207.       if (st == NULL)

crypto/stack/stack.c:205:5: assigned
  203.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  204.   {
  205.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
             ^
  206.   
  207.       if (st == NULL)

crypto/stack/stack.c:216:9: when calling `OPENSSL_sk_free` here
  214.   
  215.       if (!sk_reserve(st, n, 1)) {
  216.           OPENSSL_sk_free(st);
                 ^
  217.           return NULL;
  218.       }

crypto/stack/stack.c:368:1: parameter `st` of OPENSSL_sk_free
    366.   }
    367.   
    368. > void OPENSSL_sk_free(OPENSSL_STACK *st)
    369.   {
    370.       if (st == NULL)

crypto/stack/stack.c:372:5: when calling `CRYPTO_free` here
    370.       if (st == NULL)
    371.           return;
    372.       OPENSSL_free(st->data);
               ^
    373.       OPENSSL_free(st);
    374.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
      310.       }
      311.   #else
      312.       free(str);
                 ^
      313.   #endif
      314.   }
