crypto/lock.c:490: error: USE_AFTER_FREE
  call to `CRYPTO_lock()` eventually accesses memory that was invalidated by call to `free()` on line 476 indirectly during the call to `CRYPTO_lock()`.
Showing all 22 steps of the trace


crypto/lock.c:476:9: invalidation part of the trace starts here
474.   #endif
475.       } else {
476.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
               ^
477.   
478.           ret = *pointer + amount;

crypto/lock.c:476:9: global variable `dyn_locks` accessed here
  474.   #endif
  475.       } else {
  476.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
                 ^
  477.   
  478.           ret = *pointer + amount;

crypto/lock.c:476:9: when calling `CRYPTO_lock` here
  474.   #endif
  475.       } else {
  476.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
                 ^
  477.   
  478.           ret = *pointer + amount;

crypto/lock.c:443:19: global variable `dyn_locks` accessed here
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer
    443.                   = CRYPTO_get_dynlock_value(type);
                             ^
    444.   
    445.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:449:13: when calling `CRYPTO_destroy_dynlockid` here
    447.               dynlock_lock_callback(mode, pointer, file, line);
    448.   
    449.               CRYPTO_destroy_dynlockid(type);
                       ^
    450.           }
    451.       } else if (locking_callback != NULL)

crypto/lock.c:300:9: global variable `dyn_locks` accessed here
      298.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      299.   
      300.       if (dyn_locks == NULL || i >= sk_CRYPTO_dynlock_num(dyn_locks)) {
                     ^
      301.           CRYPTO_w_unlock(CRYPTO_LOCK_DYNLOCK);
      302.           return;

crypto/lock.c:304:15: passed as argument to `sk_CRYPTO_dynlock_value`
      302.           return;
      303.       }
      304.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      305.       if (pointer != NULL) {
      306.           --pointer->references;

crypto/lock.c:304:15: return from call to `sk_CRYPTO_dynlock_value`
      302.           return;
      303.       }
      304.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      305.       if (pointer != NULL) {
      306.           --pointer->references;

crypto/lock.c:304:5: assigned
      302.           return;
      303.       }
      304.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                 ^
      305.       if (pointer != NULL) {
      306.           --pointer->references;

crypto/lock.c:322:9: when calling `CRYPTO_free` here
      320.       if (pointer) {
      321.           dynlock_destroy_callback(pointer->data, __FILE__, __LINE__);
      322.           OPENSSL_free(pointer);
                     ^
      323.       }
      324.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
        231.   }
        232.   
        233. > void CRYPTO_free(void *str)
        234.   {
        235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
        242.       }
        243.   #else
        244.       free(str);
                   ^
        245.   #endif
        246.   }

crypto/lock.c:476:9: use-after-lifetime part of the trace starts here
474.   #endif
475.       } else {
476.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
               ^
477.   
478.           ret = *pointer + amount;

crypto/lock.c:476:9: global variable `dyn_locks` accessed here
  474.   #endif
  475.       } else {
  476.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
                 ^
  477.   
  478.           ret = *pointer + amount;

crypto/lock.c:490:9: when calling `CRYPTO_lock` here
  488.   #endif
  489.           *pointer = ret;
  490.           CRYPTO_lock(CRYPTO_UNLOCK | CRYPTO_WRITE, type, file, line);
                 ^
  491.       }
  492.       return (ret);

crypto/lock.c:443:19: global variable `dyn_locks` accessed here
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer
    443.                   = CRYPTO_get_dynlock_value(type);
                             ^
    444.   
    445.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:443:19: when calling `CRYPTO_get_dynlock_value` here
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer
    443.                   = CRYPTO_get_dynlock_value(type);
                             ^
    444.   
    445.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:334:9: global variable `dyn_locks` accessed here
      332.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      333.   
      334.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
                     ^
      335.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
      336.       if (pointer)

crypto/lock.c:335:19: passed as argument to `sk_CRYPTO_dynlock_value`
      333.   
      334.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      335.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                               ^
      336.       if (pointer)
      337.           pointer->references++;

crypto/lock.c:335:19: return from call to `sk_CRYPTO_dynlock_value`
      333.   
      334.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      335.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                               ^
      336.       if (pointer)
      337.           pointer->references++;

crypto/lock.c:335:9: assigned
      333.   
      334.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      335.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                     ^
      336.       if (pointer)
      337.           pointer->references++;

crypto/lock.c:342:16: invalid access occurs here
      340.   
      341.       if (pointer)
      342.           return pointer->data;
                            ^
      343.       return NULL;
      344.   }
