crypto/lhash/lhash.c:165: error: USE_AFTER_FREE
  call to `getrn()` eventually accesses memory that was invalidated by call to `free()` on line 163 indirectly during the call to `expand()`.
Showing all 14 steps of the trace


crypto/lhash/lhash.c:155:1: invalidation part of the trace starts here
153.   }
154.   
155. > void *lh_insert(_LHASH *lh, void *data)
156.   {
157.       unsigned long hash;

crypto/lhash/lhash.c:155:1: parameter `lh` of lh_insert
  153.   }
  154.   
  155. > void *lh_insert(_LHASH *lh, void *data)
  156.   {
  157.       unsigned long hash;

crypto/lhash/lhash.c:163:9: when calling `expand` here
  161.       lh->error = 0;
  162.       if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))
  163.           expand(lh);
                 ^
  164.   
  165.       rn = getrn(lh, data, &hash);

crypto/lhash/lhash.c:278:1: parameter `lh` of expand
    276.   }
    277.   
    278. > static void expand(_LHASH *lh)
    279.   {
    280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:305:13: when calling `CRYPTO_realloc` here
    303.       if ((lh->p) >= lh->pmax) {
    304.           j = (int)lh->num_alloc_nodes * 2;
    305.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
                       ^
    306.           if (n == NULL) {
    307.               /* fputs("realloc error in lhash",stderr); */

crypto/mem.c:168:1: parameter `str` of CRYPTO_realloc
      166.   }
      167.   
      168. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      169.   {
      170.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:177:9: when calling `CRYPTO_free` here
      175.   
      176.       if (num == 0) {
      177.           CRYPTO_free(str, file, line);
                     ^
      178.           return NULL;
      179.       }

crypto/mem.c:225:1: parameter `str` of CRYPTO_free
        223.   }
        224.   
        225. > void CRYPTO_free(void *str, const char *file, int line)
        226.   {
        227.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:241:5: was invalidated by call to `free()`
        239.       }
        240.   #else
        241.       free(str);
                   ^
        242.   #endif
        243.   }

crypto/lhash/lhash.c:155:1: use-after-lifetime part of the trace starts here
153.   }
154.   
155. > void *lh_insert(_LHASH *lh, void *data)
156.   {
157.       unsigned long hash;

crypto/lhash/lhash.c:155:1: parameter `lh` of lh_insert
  153.   }
  154.   
  155. > void *lh_insert(_LHASH *lh, void *data)
  156.   {
  157.       unsigned long hash;

crypto/lhash/lhash.c:165:10: when calling `getrn` here
  163.           expand(lh);
  164.   
  165.       rn = getrn(lh, data, &hash);
                  ^
  166.   
  167.       if (*rn == NULL) {

crypto/lhash/lhash.c:357:1: parameter `lh` of getrn
    355.   }
    356.   
    357. > static LHASH_NODE **getrn(_LHASH *lh, const void *data, unsigned long *rhash)
    358.   {
    359.       LHASH_NODE **ret, *n1;

crypto/lhash/lhash.c:372:5: invalid access occurs here
    370.   
    371.       cf = lh->comp;
    372.       ret = &(lh->b[(int)nn]);
               ^
    373.       for (n1 = *ret; n1 != NULL; n1 = n1->next) {
    374.           lh->num_hash_comps++;
