crypto/asn1/evp_asn1.c:70: error: USE_AFTER_FREE
  call to `ASN1_OCTET_STRING_free()` eventually accesses memory that was invalidated by call to `free()` on line 69 indirectly during the call to `ASN1_OCTET_STRING_set()`.
Showing all 29 steps of the trace


crypto/asn1/evp_asn1.c:67:15: invalidation part of the trace starts here
65.       ASN1_STRING *os;
66.   
67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                    ^
68.           return (0);
69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:67:15: passed as argument to `ASN1_OCTET_STRING_new`
  65.       ASN1_STRING *os;
  66.   
  67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                      ^
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:67:15: return from call to `ASN1_OCTET_STRING_new`
  65.       ASN1_STRING *os;
  66.   
  67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                      ^
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:67:10: assigned
  65.       ASN1_STRING *os;
  66.   
  67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                 ^
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:69:10: when calling `ASN1_OCTET_STRING_set` here
  67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {
                 ^
  70.           ASN1_OCTET_STRING_free(os);
  71.           return 0;

crypto/asn1/a_octet.c:73:1: parameter `x` of ASN1_OCTET_STRING_set
    71.   }
    72.   
    73. > int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d,
    74.                             int len)
    75.   {

crypto/asn1/a_octet.c:76:12: when calling `ASN1_STRING_set` here
    74.                             int len)
    75.   {
    76.       return ASN1_STRING_set(x, d, len);
                     ^
    77.   }

crypto/asn1/asn1_lib.c:307:1: parameter `str` of ASN1_STRING_set
      305.   }
      306.   
      307. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
      308.   {
      309.       unsigned char *c;

crypto/asn1/asn1_lib.c:319:9: assigned
      317.       }
      318.       if ((str->length < len) || (str->data == NULL)) {
      319.           c = str->data;
                     ^
      320.           str->data = OPENSSL_realloc(c, len + 1);
      321.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:320:21: when calling `CRYPTO_realloc` here
      318.       if ((str->length < len) || (str->data == NULL)) {
      319.           c = str->data;
      320.           str->data = OPENSSL_realloc(c, len + 1);
                                 ^
      321.           if (str->data == NULL) {
      322.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:165:1: parameter `str` of CRYPTO_realloc
        163.   }
        164.   
        165. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
        166.   {
        167.       if (str == NULL)

crypto/mem.c:171:9: when calling `CRYPTO_free` here
        169.   
        170.       if (num == 0) {
        171.           CRYPTO_free(str);
                       ^
        172.           return NULL;
        173.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
          231.   }
          232.   
          233. > void CRYPTO_free(void *str)
          234.   {
          235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
          242.       }
          243.   #else
          244.       free(str);
                     ^
          245.   #endif
          246.   }

crypto/asn1/evp_asn1.c:67:15: use-after-lifetime part of the trace starts here
65.       ASN1_STRING *os;
66.   
67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                    ^
68.           return (0);
69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:67:15: passed as argument to `ASN1_OCTET_STRING_new`
  65.       ASN1_STRING *os;
  66.   
  67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                      ^
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:67:15: return from call to `ASN1_OCTET_STRING_new`
  65.       ASN1_STRING *os;
  66.   
  67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                      ^
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:67:10: assigned
  65.       ASN1_STRING *os;
  66.   
  67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
                 ^
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {

crypto/asn1/evp_asn1.c:69:10: passed as argument to `ASN1_OCTET_STRING_set`
  67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {
                 ^
  70.           ASN1_OCTET_STRING_free(os);
  71.           return 0;

crypto/asn1/a_octet.c:73:1: parameter `x` of ASN1_OCTET_STRING_set
    71.   }
    72.   
    73. > int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d,
    74.                             int len)
    75.   {

crypto/asn1/a_octet.c:76:12: passed as argument to `ASN1_STRING_set`
    74.                             int len)
    75.   {
    76.       return ASN1_STRING_set(x, d, len);
                     ^
    77.   }

crypto/asn1/asn1_lib.c:307:1: parameter `str` of ASN1_STRING_set
      305.   }
      306.   
      307. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
      308.   {
      309.       unsigned char *c;

crypto/asn1/asn1_lib.c:319:9: assigned
      317.       }
      318.       if ((str->length < len) || (str->data == NULL)) {
      319.           c = str->data;
                     ^
      320.           str->data = OPENSSL_realloc(c, len + 1);
      321.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:323:13: assigned
      321.           if (str->data == NULL) {
      322.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
      323.               str->data = c;
                         ^
      324.               return (0);
      325.           }

crypto/asn1/a_octet.c:76:12: return from call to `ASN1_STRING_set`
    74.                             int len)
    75.   {
    76.       return ASN1_STRING_set(x, d, len);
                     ^
    77.   }

crypto/asn1/evp_asn1.c:69:10: return from call to `ASN1_OCTET_STRING_set`
  67.       if ((os = ASN1_OCTET_STRING_new()) == NULL)
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {
                 ^
  70.           ASN1_OCTET_STRING_free(os);
  71.           return 0;

crypto/asn1/evp_asn1.c:70:9: when calling `ASN1_OCTET_STRING_free` here
  68.           return (0);
  69.       if (!ASN1_OCTET_STRING_set(os, data, len)) {
  70.           ASN1_OCTET_STRING_free(os);
                ^
  71.           return 0;
  72.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }
