crypto/x509v3/v3_pci.c:152: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 138 indirectly during the call to `CRYPTO_realloc()`.
Showing all 16 steps of the trace


crypto/x509v3/v3_pci.c:121:23: invalidation part of the trace starts here
119.           long val_len;
120.           if (!*policy) {
121.               *policy = ASN1_OCTET_STRING_new();
                             ^
122.               if (*policy == NULL) {
123.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:121:23: passed as argument to `ASN1_OCTET_STRING_new`
  119.           long val_len;
  120.           if (!*policy) {
  121.               *policy = ASN1_OCTET_STRING_new();
                               ^
  122.               if (*policy == NULL) {
  123.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:121:23: return from call to `ASN1_OCTET_STRING_new`
  119.           long val_len;
  120.           if (!*policy) {
  121.               *policy = ASN1_OCTET_STRING_new();
                               ^
  122.               if (*policy == NULL) {
  123.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:121:13: assigned
  119.           long val_len;
  120.           if (!*policy) {
  121.               *policy = ASN1_OCTET_STRING_new();
                     ^
  122.               if (*policy == NULL) {
  123.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:138:24: when calling `CRYPTO_realloc` here
  136.               }
  137.   
  138.               tmp_data = OPENSSL_realloc((*policy)->data,
                                ^
  139.                                          (*policy)->length + val_len + 1);
  140.               if (tmp_data) {

crypto/mem.c:207:1: parameter `str` of CRYPTO_realloc
    205.   }
    206.   
    207. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    208.   {
    209.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:217:9: when calling `CRYPTO_free` here
    215.   
    216.       if (num == 0) {
    217.           CRYPTO_free(str, file, line);
                   ^
    218.           return NULL;
    219.       }

crypto/mem.c:264:1: parameter `str` of CRYPTO_free
      262.   }
      263.   
      264. > void CRYPTO_free(void *str, const char *file, int line)
      265.   {
      266.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:280:5: was invalidated by call to `free()`
      278.       }
      279.   #else
      280.       free(str);
                 ^
      281.   #endif
      282.   }

crypto/x509v3/v3_pci.c:121:23: use-after-lifetime part of the trace starts here
119.           long val_len;
120.           if (!*policy) {
121.               *policy = ASN1_OCTET_STRING_new();
                             ^
122.               if (*policy == NULL) {
123.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:121:23: passed as argument to `ASN1_OCTET_STRING_new`
  119.           long val_len;
  120.           if (!*policy) {
  121.               *policy = ASN1_OCTET_STRING_new();
                               ^
  122.               if (*policy == NULL) {
  123.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:121:23: return from call to `ASN1_OCTET_STRING_new`
  119.           long val_len;
  120.           if (!*policy) {
  121.               *policy = ASN1_OCTET_STRING_new();
                               ^
  122.               if (*policy == NULL) {
  123.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:121:13: assigned
  119.           long val_len;
  120.           if (!*policy) {
  121.               *policy = ASN1_OCTET_STRING_new();
                     ^
  122.               if (*policy == NULL) {
  123.                   X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_pci.c:152:17: when calling `CRYPTO_free` here
  150.                    * too!
  151.                    */
  152.                   OPENSSL_free((*policy)->data);
                         ^
  153.                   (*policy)->data = NULL;
  154.                   (*policy)->length = 0;

crypto/mem.c:264:1: parameter `str` of CRYPTO_free
    262.   }
    263.   
    264. > void CRYPTO_free(void *str, const char *file, int line)
    265.   {
    266.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:280:5: invalid access occurs here
    278.       }
    279.   #else
    280.       free(str);
               ^
    281.   #endif
    282.   }
