crypto/asn1/asn_mime.c:432: error: USE_AFTER_FREE
  call to `mime_hdr_find()` eventually accesses memory that was invalidated by call to `free()` on line 427 indirectly during the call to `mime_parse_hdr()`.
Showing all 29 steps of the trace


crypto/asn1/asn_mime.c:427:20: invalidation part of the trace starts here
425.           *bcont = NULL;
426.   
427.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                          ^
428.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
429.           return NULL;

crypto/asn1/asn_mime.c:427:20: when calling `mime_parse_hdr` here
  425.           *bcont = NULL;
  426.   
  427.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                            ^
  428.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
  429.           return NULL;

crypto/asn1/asn_mime.c:676:15: passed as argument to `sk_MIME_HEADER_new`
    674.       int len, state, save_state = 0;
    675.   
    676.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
                         ^
    677.       if (headers == NULL)
    678.           return NULL;

crypto/asn1/asn_mime.c:676:15: return from call to `sk_MIME_HEADER_new`
    674.       int len, state, save_state = 0;
    675.   
    676.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
                         ^
    677.       if (headers == NULL)
    678.           return NULL;

crypto/asn1/asn_mime.c:676:5: assigned
    674.       int len, state, save_state = 0;
    675.   
    676.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
               ^
    677.       if (headers == NULL)
    678.           return NULL;

crypto/asn1/asn_mime.c:710:21: when calling `sk_MIME_HEADER_push` here
    708.                       *p = 0;
    709.                       mhdr = mime_hdr_new(ntmp, strip_ends(q));
    710.                       sk_MIME_HEADER_push(headers, mhdr);
                               ^
    711.                       ntmp = NULL;
    712.                       q = p + 1;

crypto/asn1/asn1_locl.h:92:1: parameter `sk` of sk_MIME_HEADER_push
      90.   DEFINE_STACK_OF(MIME_PARAM)
      91.   typedef struct mime_header_st MIME_HEADER;
      92. > DEFINE_STACK_OF(MIME_HEADER)
      93.   
      94.   /* Month values for printing out times */

crypto/asn1/asn1_locl.h:92:1: when calling `sk_push` here
      90.   DEFINE_STACK_OF(MIME_PARAM)
      91.   typedef struct mime_header_st MIME_HEADER;
      92. > DEFINE_STACK_OF(MIME_HEADER)
      93.   
      94.   /* Month values for printing out times */

crypto/stack/stack.c:258:1: parameter `st` of sk_push
        256.   }
        257.   
        258. > int sk_push(_STACK *st, void *data)
        259.   {
        260.       return (sk_insert(st, data, st->num));

crypto/stack/stack.c:260:13: when calling `sk_insert` here
        258.   int sk_push(_STACK *st, void *data)
        259.   {
        260.       return (sk_insert(st, data, st->num));
                           ^
        261.   }
        262.   

crypto/stack/stack.c:166:1: parameter `st` of sk_insert
          164.   }
          165.   
          166. > int sk_insert(_STACK *st, void *data, int loc)
          167.   {
          168.       char **s;

crypto/stack/stack.c:173:13: when calling `CRYPTO_realloc` here
          171.           return 0;
          172.       if (st->num_alloc <= st->num + 1) {
          173.           s = OPENSSL_realloc((char *)st->data,
                             ^
          174.                               (unsigned int)sizeof(char *) * st->num_alloc * 2);
          175.           if (s == NULL)

crypto/mem.c:165:1: parameter `str` of CRYPTO_realloc
            163.   }
            164.   
            165. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            166.   {
            167.       if (str == NULL)

crypto/mem.c:171:9: when calling `CRYPTO_free` here
            169.   
            170.       if (num == 0) {
            171.           CRYPTO_free(str);
                           ^
            172.           return NULL;
            173.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
              231.   }
              232.   
              233. > void CRYPTO_free(void *str)
              234.   {
              235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
              242.       }
              243.   #else
              244.       free(str);
                         ^
              245.   #endif
              246.   }

crypto/asn1/asn_mime.c:427:20: use-after-lifetime part of the trace starts here
425.           *bcont = NULL;
426.   
427.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                          ^
428.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
429.           return NULL;

crypto/asn1/asn_mime.c:427:20: passed as argument to `mime_parse_hdr`
  425.           *bcont = NULL;
  426.   
  427.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                            ^
  428.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
  429.           return NULL;

crypto/asn1/asn_mime.c:676:15: passed as argument to `sk_MIME_HEADER_new`
    674.       int len, state, save_state = 0;
    675.   
    676.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
                         ^
    677.       if (headers == NULL)
    678.           return NULL;

crypto/asn1/asn_mime.c:676:15: return from call to `sk_MIME_HEADER_new`
    674.       int len, state, save_state = 0;
    675.   
    676.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
                         ^
    677.       if (headers == NULL)
    678.           return NULL;

crypto/asn1/asn_mime.c:676:5: assigned
    674.       int len, state, save_state = 0;
    675.   
    676.       headers = sk_MIME_HEADER_new(mime_hdr_cmp);
               ^
    677.       if (headers == NULL)
    678.           return NULL;

crypto/asn1/asn_mime.c:427:20: return from call to `mime_parse_hdr`
  425.           *bcont = NULL;
  426.   
  427.       if ((headers = mime_parse_hdr(bio)) == NULL) {
                            ^
  428.           ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
  429.           return NULL;

crypto/asn1/asn_mime.c:432:16: when calling `mime_hdr_find` here
  430.       }
  431.   
  432.       if ((hdr = mime_hdr_find(headers, "content-type")) == NULL
                        ^
  433.           || hdr->value == NULL) {
  434.           sk_MIME_HEADER_pop_free(headers, mime_hdr_free);

crypto/asn1/asn_mime.c:921:1: parameter `hdrs` of mime_hdr_find
    919.   /* Find a header with a given name (if possible) */
    920.   
    921. > static MIME_HEADER *mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, char *name)
    922.   {
    923.       MIME_HEADER htmp;

crypto/asn1/asn_mime.c:929:12: when calling `sk_MIME_HEADER_value` here
    927.       if (idx < 0)
    928.           return NULL;
    929.       return sk_MIME_HEADER_value(hdrs, idx);
                      ^
    930.   }
    931.   

crypto/asn1/asn1_locl.h:92:1: parameter `sk` of sk_MIME_HEADER_value
      90.   DEFINE_STACK_OF(MIME_PARAM)
      91.   typedef struct mime_header_st MIME_HEADER;
      92. > DEFINE_STACK_OF(MIME_HEADER)
      93.   
      94.   /* Month values for printing out times */

crypto/asn1/asn1_locl.h:92:1: when calling `sk_value` here
      90.   DEFINE_STACK_OF(MIME_PARAM)
      91.   typedef struct mime_header_st MIME_HEADER;
      92. > DEFINE_STACK_OF(MIME_HEADER)
      93.   
      94.   /* Month values for printing out times */

crypto/stack/stack.c:323:1: parameter `st` of sk_value
        321.   }
        322.   
        323. > void *sk_value(const _STACK *st, int i)
        324.   {
        325.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:327:12: invalid access occurs here
        325.       if (!st || (i < 0) || (i >= st->num))
        326.           return NULL;
        327.       return st->data[i];
                          ^
        328.   }
        329.   
