test/ssltest_old.c:2762: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 2761 indirectly during the call to `CRYPTO_free()`.
Showing all 18 steps of the trace


test/ssltest_old.c:2506:14: invalidation part of the trace starts here
2504.       int err_in_server = 0;
2505.   
2506.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2507.   
2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2506:14: assigned
  2504.       int err_in_server = 0;
  2505.   
  2506.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2507.   
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2506:5: assigned
  2504.       int err_in_server = 0;
  2505.   
  2506.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2507.   
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2508:17: passed as argument to `CRYPTO_zalloc`
  2506.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2507.   
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2509.           goto err;
  2510.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2508:17: return from call to `CRYPTO_zalloc`
  2506.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2507.   
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2509.           goto err;
  2510.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2508:10: assigned
  2506.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2507.   
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2509.           goto err;
  2510.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2761:5: when calling `CRYPTO_free` here
  2759.       BIO_free_all(c_bio);
  2760.       BIO_free_all(s_bio);
  2761.       OPENSSL_free(cbuf);
              ^
  2762.       OPENSSL_free(sbuf);
  2763.   

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
    251.   }
    252.   
    253. > void CRYPTO_free(void *str, const char *file, int line)
    254.   {
    255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: was invalidated by call to `free()`
    267.       }
    268.   #else
    269.       free(str);
               ^
    270.   #endif
    271.   }

test/ssltest_old.c:2506:14: use-after-lifetime part of the trace starts here
2504.       int err_in_server = 0;
2505.   
2506.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2507.   
2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2506:14: assigned
  2504.       int err_in_server = 0;
  2505.   
  2506.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2507.   
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2506:5: assigned
  2504.       int err_in_server = 0;
  2505.   
  2506.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2507.   
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2510:17: passed as argument to `CRYPTO_zalloc`
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2509.           goto err;
  2510.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2511.           goto err;
  2512.   

test/ssltest_old.c:2510:17: return from call to `CRYPTO_zalloc`
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2509.           goto err;
  2510.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2511.           goto err;
  2512.   

test/ssltest_old.c:2510:10: assigned
  2508.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2509.           goto err;
  2510.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2511.           goto err;
  2512.   

test/ssltest_old.c:2762:5: when calling `CRYPTO_free` here
  2760.       BIO_free_all(s_bio);
  2761.       OPENSSL_free(cbuf);
  2762.       OPENSSL_free(sbuf);
              ^
  2763.   
  2764.       if (should_negotiate != NULL && strcmp(should_negotiate, "fail-client") == 0)

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
    251.   }
    252.   
    253. > void CRYPTO_free(void *str, const char *file, int line)
    254.   {
    255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: invalid access occurs here
    267.       }
    268.   #else
    269.       free(str);
               ^
    270.   #endif
    271.   }
