crypto/x509v3/v3_ia5.c:55: error: USE_AFTER_FREE
  call to `ASN1_IA5STRING_free()` eventually accesses memory that was invalidated by call to `free()` on line 54 indirectly during the call to `ASN1_STRING_set()`.
Showing all 24 steps of the trace


crypto/x509v3/v3_ia5.c:52:16: invalidation part of the trace starts here
50.           return NULL;
51.       }
52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                     ^
53.           goto err;
54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {

crypto/x509v3/v3_ia5.c:52:16: passed as argument to `ASN1_IA5STRING_new`
  50.           return NULL;
  51.       }
  52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                       ^
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {

crypto/x509v3/v3_ia5.c:52:16: return from call to `ASN1_IA5STRING_new`
  50.           return NULL;
  51.       }
  52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                       ^
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {

crypto/x509v3/v3_ia5.c:52:10: assigned
  50.           return NULL;
  51.       }
  52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                 ^
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {

crypto/x509v3/v3_ia5.c:54:10: when calling `ASN1_STRING_set` here
  52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {
                 ^
  55.           ASN1_IA5STRING_free(ia5);
  56.           return NULL;

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
    269.   }
    270.   
    271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
    272.   {
    273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
    281.       }
    282.       if ((str->length <= len) || (str->data == NULL)) {
    283.           c = str->data;
                   ^
    284.           str->data = OPENSSL_realloc(c, len + 1);
    285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:284:21: when calling `CRYPTO_realloc` here
    282.       if ((str->length <= len) || (str->data == NULL)) {
    283.           c = str->data;
    284.           str->data = OPENSSL_realloc(c, len + 1);
                               ^
    285.           if (str->data == NULL) {
    286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
      236.   }
      237.   
      238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      239.   {
      240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
      247.   
      248.       if (num == 0) {
      249.           CRYPTO_free(str, file, line);
                     ^
      250.           return NULL;
      251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
        293.   }
        294.   
        295. > void CRYPTO_free(void *str, const char *file, int line)
        296.   {
        297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
        310.       }
        311.   #else
        312.       free(str);
                   ^
        313.   #endif
        314.   }

crypto/x509v3/v3_ia5.c:52:16: use-after-lifetime part of the trace starts here
50.           return NULL;
51.       }
52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                     ^
53.           goto err;
54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {

crypto/x509v3/v3_ia5.c:52:16: passed as argument to `ASN1_IA5STRING_new`
  50.           return NULL;
  51.       }
  52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                       ^
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {

crypto/x509v3/v3_ia5.c:52:16: return from call to `ASN1_IA5STRING_new`
  50.           return NULL;
  51.       }
  52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                       ^
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {

crypto/x509v3/v3_ia5.c:52:10: assigned
  50.           return NULL;
  51.       }
  52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
                 ^
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {

crypto/x509v3/v3_ia5.c:54:10: passed as argument to `ASN1_STRING_set`
  52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {
                 ^
  55.           ASN1_IA5STRING_free(ia5);
  56.           return NULL;

crypto/asn1/asn1_lib.c:271:1: parameter `str` of ASN1_STRING_set
    269.   }
    270.   
    271. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
    272.   {
    273.       unsigned char *c;

crypto/asn1/asn1_lib.c:283:9: assigned
    281.       }
    282.       if ((str->length <= len) || (str->data == NULL)) {
    283.           c = str->data;
                   ^
    284.           str->data = OPENSSL_realloc(c, len + 1);
    285.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:287:13: assigned
    285.           if (str->data == NULL) {
    286.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
    287.               str->data = c;
                       ^
    288.               return 0;
    289.           }

crypto/x509v3/v3_ia5.c:54:10: return from call to `ASN1_STRING_set`
  52.       if ((ia5 = ASN1_IA5STRING_new()) == NULL)
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {
                 ^
  55.           ASN1_IA5STRING_free(ia5);
  56.           return NULL;

crypto/x509v3/v3_ia5.c:55:9: when calling `ASN1_IA5STRING_free` here
  53.           goto err;
  54.       if (!ASN1_STRING_set((ASN1_STRING *)ia5, str, strlen(str))) {
  55.           ASN1_IA5STRING_free(ia5);
                ^
  56.           return NULL;
  57.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }
