test/ssltest_old.c:2917: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 2916 indirectly during the call to `CRYPTO_free()`.
Showing all 18 steps of the trace


test/ssltest_old.c:2651:14: invalidation part of the trace starts here
2649.       int err_in_server = 0;
2650.   
2651.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2652.   
2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2651:14: assigned
  2649.       int err_in_server = 0;
  2650.   
  2651.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2652.   
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2651:5: assigned
  2649.       int err_in_server = 0;
  2650.   
  2651.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2652.   
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2653:17: passed as argument to `CRYPTO_zalloc`
  2651.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2652.   
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2654.           goto err;
  2655.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2653:17: return from call to `CRYPTO_zalloc`
  2651.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2652.   
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2654.           goto err;
  2655.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2653:10: assigned
  2651.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2652.   
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2654.           goto err;
  2655.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2916:5: when calling `CRYPTO_free` here
  2914.       BIO_free_all(c_bio);
  2915.       BIO_free_all(s_bio);
  2916.       OPENSSL_free(cbuf);
              ^
  2917.       OPENSSL_free(sbuf);
  2918.   

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
    161.   }
    162.   
    163. > void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
    177.       }
    178.   #else
    179.       free(str);
               ^
    180.   #endif
    181.   }

test/ssltest_old.c:2651:14: use-after-lifetime part of the trace starts here
2649.       int err_in_server = 0;
2650.   
2651.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2652.   
2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2651:14: assigned
  2649.       int err_in_server = 0;
  2650.   
  2651.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2652.   
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2651:5: assigned
  2649.       int err_in_server = 0;
  2650.   
  2651.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2652.   
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2655:17: passed as argument to `CRYPTO_zalloc`
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2654.           goto err;
  2655.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2656.           goto err;
  2657.   

test/ssltest_old.c:2655:17: return from call to `CRYPTO_zalloc`
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2654.           goto err;
  2655.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2656.           goto err;
  2657.   

test/ssltest_old.c:2655:10: assigned
  2653.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2654.           goto err;
  2655.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2656.           goto err;
  2657.   

test/ssltest_old.c:2917:5: when calling `CRYPTO_free` here
  2915.       BIO_free_all(s_bio);
  2916.       OPENSSL_free(cbuf);
  2917.       OPENSSL_free(sbuf);
              ^
  2918.   
  2919.       if (should_negotiate != NULL && strcmp(should_negotiate, "fail-client") == 0)

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
    161.   }
    162.   
    163. > void CRYPTO_free(void *str, const char *file, int line)
    164.   {
    165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: invalid access occurs here
    177.       }
    178.   #else
    179.       free(str);
               ^
    180.   #endif
    181.   }
