ssl/bio_ssl.c:289: error: USE_AFTER_FREE
  accessing memory that was invalidated by call to `free()` on line 283 indirectly during the call to `ssl_free()`.
Showing all 16 steps of the trace


ssl/bio_ssl.c:223:1: invalidation part of the trace starts here
221.   }
222.   
223. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
224.   {
225.       SSL **sslp, *ssl;

ssl/bio_ssl.c:223:1: parameter `b` of ssl_ctrl
  221.   }
  222.   
  223. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
  224.   {
  225.       SSL **sslp, *ssl;

ssl/bio_ssl.c:283:13: when calling `ssl_free` here
  281.       case BIO_C_SET_SSL:
  282.           if (ssl != NULL) {
  283.               ssl_free(b);
                     ^
  284.               if (!ssl_new(b))
  285.                   return 0;

ssl/bio_ssl.c:71:1: parameter `a` of ssl_free
    69.   }
    70.   
    71. > static int ssl_free(BIO *a)
    72.   {
    73.       BIO_SSL *bs;

ssl/bio_ssl.c:77:10: passed as argument to `BIO_get_data`
    75.       if (a == NULL)
    76.           return (0);
    77.       bs = BIO_get_data(a);
                   ^
    78.       if (bs->ssl != NULL)
    79.           SSL_shutdown(bs->ssl);

ssl/bio_ssl.c:77:10: return from call to `BIO_get_data`
    75.       if (a == NULL)
    76.           return (0);
    77.       bs = BIO_get_data(a);
                   ^
    78.       if (bs->ssl != NULL)
    79.           SSL_shutdown(bs->ssl);

ssl/bio_ssl.c:77:5: assigned
    75.       if (a == NULL)
    76.           return (0);
    77.       bs = BIO_get_data(a);
              ^
    78.       if (bs->ssl != NULL)
    79.           SSL_shutdown(bs->ssl);

ssl/bio_ssl.c:87:5: when calling `CRYPTO_free` here
    85.           BIO_set_init(a, 0);
    86.       }
    87.       OPENSSL_free(bs);
              ^
    88.       return 1;
    89.   }

crypto/mem.c:264:1: parameter `str` of CRYPTO_free
      262.   }
      263.   
      264. > void CRYPTO_free(void *str, const char *file, int line)
      265.   {
      266.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:280:5: was invalidated by call to `free()`
      278.       }
      279.   #else
      280.       free(str);
                 ^
      281.   #endif
      282.   }

ssl/bio_ssl.c:223:1: use-after-lifetime part of the trace starts here
221.   }
222.   
223. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
224.   {
225.       SSL **sslp, *ssl;

ssl/bio_ssl.c:223:1: parameter `b` of ssl_ctrl
  221.   }
  222.   
  223. > static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
  224.   {
  225.       SSL **sslp, *ssl;

ssl/bio_ssl.c:231:10: passed as argument to `BIO_get_data`
  229.       BIO *next;
  230.   
  231.       bs = BIO_get_data(b);
                  ^
  232.       next = BIO_next(b);
  233.       ssl = bs->ssl;

ssl/bio_ssl.c:231:10: return from call to `BIO_get_data`
  229.       BIO *next;
  230.   
  231.       bs = BIO_get_data(b);
                  ^
  232.       next = BIO_next(b);
  233.       ssl = bs->ssl;

ssl/bio_ssl.c:231:5: assigned
  229.       BIO *next;
  230.   
  231.       bs = BIO_get_data(b);
             ^
  232.       next = BIO_next(b);
  233.       ssl = bs->ssl;

ssl/bio_ssl.c:289:9: invalid access occurs here
  287.           BIO_set_shutdown(b, num);
  288.           ssl = (SSL *)ptr;
  289.           bs->ssl = ssl;
                 ^
  290.           bio = SSL_get_rbio(ssl);
  291.           if (bio != NULL) {
