ssl/bio_ssl.c:290: error: USE_AFTER_FREE
  accessing memory that was invalidated by call to `free()` on line 284 indirectly during the call to `ssl_free()`.
Showing all 16 steps of the trace


ssl/bio_ssl.c:224:1: invalidation part of the trace starts here
222.   }
223.   
224. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
225.   {
226.       SSL **sslp, *ssl;

ssl/bio_ssl.c:224:1: parameter `b` of ssl_ctrl
  222.   }
  223.   
  224. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
  225.   {
  226.       SSL **sslp, *ssl;

ssl/bio_ssl.c:284:13: when calling `ssl_free` here
  282.       case BIO_C_SET_SSL:
  283.           if (ssl != NULL) {
  284.               ssl_free(b);
                     ^
  285.               if (!ssl_new(b))
  286.                   return 0;

ssl/bio_ssl.c:72:1: parameter `a` of ssl_free
    70.   }
    71.   
    72. > static int ssl_free(BIO *a)
    73.   {
    74.       BIO_SSL *bs;

ssl/bio_ssl.c:78:10: passed as argument to `BIO_get_data`
    76.       if (a == NULL)
    77.           return 0;
    78.       bs = BIO_get_data(a);
                   ^
    79.       if (bs->ssl != NULL)
    80.           SSL_shutdown(bs->ssl);

ssl/bio_ssl.c:78:10: return from call to `BIO_get_data`
    76.       if (a == NULL)
    77.           return 0;
    78.       bs = BIO_get_data(a);
                   ^
    79.       if (bs->ssl != NULL)
    80.           SSL_shutdown(bs->ssl);

ssl/bio_ssl.c:78:5: assigned
    76.       if (a == NULL)
    77.           return 0;
    78.       bs = BIO_get_data(a);
              ^
    79.       if (bs->ssl != NULL)
    80.           SSL_shutdown(bs->ssl);

ssl/bio_ssl.c:88:5: when calling `CRYPTO_free` here
    86.           BIO_set_init(a, 0);
    87.       }
    88.       OPENSSL_free(bs);
              ^
    89.       return 1;
    90.   }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
      310.       }
      311.   #else
      312.       free(str);
                 ^
      313.   #endif
      314.   }

ssl/bio_ssl.c:224:1: use-after-lifetime part of the trace starts here
222.   }
223.   
224. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
225.   {
226.       SSL **sslp, *ssl;

ssl/bio_ssl.c:224:1: parameter `b` of ssl_ctrl
  222.   }
  223.   
  224. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
  225.   {
  226.       SSL **sslp, *ssl;

ssl/bio_ssl.c:232:10: passed as argument to `BIO_get_data`
  230.       BIO *next;
  231.   
  232.       bs = BIO_get_data(b);
                  ^
  233.       next = BIO_next(b);
  234.       ssl = bs->ssl;

ssl/bio_ssl.c:232:10: return from call to `BIO_get_data`
  230.       BIO *next;
  231.   
  232.       bs = BIO_get_data(b);
                  ^
  233.       next = BIO_next(b);
  234.       ssl = bs->ssl;

ssl/bio_ssl.c:232:5: assigned
  230.       BIO *next;
  231.   
  232.       bs = BIO_get_data(b);
             ^
  233.       next = BIO_next(b);
  234.       ssl = bs->ssl;

ssl/bio_ssl.c:290:9: invalid access occurs here
  288.           BIO_set_shutdown(b, num);
  289.           ssl = (SSL *)ptr;
  290.           bs->ssl = ssl;
                 ^
  291.           bio = SSL_get_rbio(ssl);
  292.           if (bio != NULL) {
