crypto/x509v3/v3_pci.c:148: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 134 indirectly during the call to `CRYPTO_realloc()`.
Showing all 12 steps of the trace


crypto/x509v3/v3_pci.c:81:1: invalidation part of the trace starts here
79.   }
80.   
81. > static int process_pci_value(CONF_VALUE *val,
82.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
83.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:81:1: parameter `policy` of process_pci_value
  79.   }
  80.   
  81. > static int process_pci_value(CONF_VALUE *val,
  82.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  83.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:134:24: when calling `CRYPTO_realloc` here
  132.               }
  133.   
  134.               tmp_data = OPENSSL_realloc((*policy)->data,
                                ^
  135.                                          (*policy)->length + val_len + 1);
  136.               if (tmp_data) {

crypto/mem.c:107:1: parameter `str` of CRYPTO_realloc
    105.   }
    106.   
    107. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    108.   {
    109.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:116:9: when calling `CRYPTO_free` here
    114.   
    115.       if (num == 0) {
    116.           CRYPTO_free(str, file, line);
                   ^
    117.           return NULL;
    118.       }

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
      161.   }
      162.   
      163. > void CRYPTO_free(void *str, const char *file, int line)
      164.   {
      165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
      177.       }
      178.   #else
      179.       free(str);
                 ^
      180.   #endif
      181.   }

crypto/x509v3/v3_pci.c:81:1: use-after-lifetime part of the trace starts here
79.   }
80.   
81. > static int process_pci_value(CONF_VALUE *val,
82.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
83.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:81:1: parameter `policy` of process_pci_value
  79.   }
  80.   
  81. > static int process_pci_value(CONF_VALUE *val,
  82.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  83.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:148:17: when calling `CRYPTO_free` here
  146.                    * too!
  147.                    */
  148.                   OPENSSL_free((*policy)->data);
                         ^
  149.                   (*policy)->data = NULL;
  150.                   (*policy)->length = 0;

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
    161.   }
    162.   
    163. > void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: invalid access occurs here
    177.       }
    178.   #else
    179.       free(str);
               ^
    180.   #endif
    181.   }
