crypto/ct/ct_oct.c:284: error: USE_AFTER_FREE
  call to `SCT_free()` eventually accesses memory that was invalidated by call to `free()` on line 284 indirectly during the call to `SCT_free()`.
Showing all 22 steps of the trace


crypto/ct/ct_oct.c:257:1: invalidation part of the trace starts here
255.   }
256.   
257. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
258.                               size_t len)
259.   {

crypto/ct/ct_oct.c:257:1: parameter `a` of o2i_SCT_LIST
  255.   }
  256.   
  257. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
  258.                               size_t len)
  259.   {

crypto/ct/ct_oct.c:282:9: assigned
  280.   
  281.           /* Use the given stack, but empty it first. */
  282.           sk = *a;
                 ^
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
  284.               SCT_free(sct);

crypto/ct/ct_oct.c:283:23: passed as argument to `sk_SCT_pop`
  281.           /* Use the given stack, but empty it first. */
  282.           sk = *a;
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  284.               SCT_free(sct);
  285.       }

crypto/ct/ct_oct.c:283:23: return from call to `sk_SCT_pop`
  281.           /* Use the given stack, but empty it first. */
  282.           sk = *a;
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  284.               SCT_free(sct);
  285.       }

crypto/ct/ct_oct.c:283:17: assigned
  281.           /* Use the given stack, but empty it first. */
  282.           sk = *a;
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
                         ^
  284.               SCT_free(sct);
  285.       }

crypto/ct/ct_oct.c:284:13: when calling `SCT_free` here
  282.           sk = *a;
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
  284.               SCT_free(sct);
                     ^
  285.       }
  286.   

crypto/ct/ct_sct.c:36:1: parameter `sct` of SCT_free
    34.   }
    35.   
    36. > void SCT_free(SCT *sct)
    37.   {
    38.       if (sct == NULL)

crypto/ct/ct_sct.c:42:5: when calling `CRYPTO_free` here
    40.   
    41.       OPENSSL_free(sct->log_id);
    42.       OPENSSL_free(sct->ext);
              ^
    43.       OPENSSL_free(sct->sig);
    44.       OPENSSL_free(sct->sct);

crypto/mem.c:286:1: parameter `str` of CRYPTO_free
      284.   }
      285.   
      286. > void CRYPTO_free(void *str, const char *file, int line)
      287.   {
      288.       INCREMENT(free_count);

crypto/mem.c:303:5: was invalidated by call to `free()`
      301.       }
      302.   #else
      303.       free(str);
                 ^
      304.   #endif
      305.   }

crypto/ct/ct_oct.c:257:1: use-after-lifetime part of the trace starts here
255.   }
256.   
257. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
258.                               size_t len)
259.   {

crypto/ct/ct_oct.c:257:1: parameter `a` of o2i_SCT_LIST
  255.   }
  256.   
  257. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
  258.                               size_t len)
  259.   {

crypto/ct/ct_oct.c:282:9: assigned
  280.   
  281.           /* Use the given stack, but empty it first. */
  282.           sk = *a;
                 ^
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
  284.               SCT_free(sct);

crypto/ct/ct_oct.c:283:23: passed as argument to `sk_SCT_pop`
  281.           /* Use the given stack, but empty it first. */
  282.           sk = *a;
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  284.               SCT_free(sct);
  285.       }

crypto/ct/ct_oct.c:283:23: return from call to `sk_SCT_pop`
  281.           /* Use the given stack, but empty it first. */
  282.           sk = *a;
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  284.               SCT_free(sct);
  285.       }

crypto/ct/ct_oct.c:283:17: assigned
  281.           /* Use the given stack, but empty it first. */
  282.           sk = *a;
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
                         ^
  284.               SCT_free(sct);
  285.       }

crypto/ct/ct_oct.c:284:13: when calling `SCT_free` here
  282.           sk = *a;
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
  284.               SCT_free(sct);
                     ^
  285.       }
  286.   

crypto/ct/ct_sct.c:36:1: parameter `sct` of SCT_free
    34.   }
    35.   
    36. > void SCT_free(SCT *sct)
    37.   {
    38.       if (sct == NULL)

crypto/ct/ct_sct.c:42:5: when calling `CRYPTO_free` here
    40.   
    41.       OPENSSL_free(sct->log_id);
    42.       OPENSSL_free(sct->ext);
              ^
    43.       OPENSSL_free(sct->sig);
    44.       OPENSSL_free(sct->sct);

crypto/mem.c:286:1: parameter `str` of CRYPTO_free
      284.   }
      285.   
      286. > void CRYPTO_free(void *str, const char *file, int line)
      287.   {
      288.       INCREMENT(free_count);

crypto/mem.c:303:5: invalid access occurs here
      301.       }
      302.   #else
      303.       free(str);
                 ^
      304.   #endif
      305.   }
