test/ssltest_old.c:2793: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 2792 indirectly during the call to `CRYPTO_free()`.
Showing all 18 steps of the trace


test/ssltest_old.c:2537:14: invalidation part of the trace starts here
2535.       int err_in_server = 0;
2536.   
2537.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2538.   
2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2537:14: assigned
  2535.       int err_in_server = 0;
  2536.   
  2537.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2538.   
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2537:5: assigned
  2535.       int err_in_server = 0;
  2536.   
  2537.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2538.   
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2539:17: passed as argument to `CRYPTO_zalloc`
  2537.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2538.   
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2540.           goto err;
  2541.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2539:17: return from call to `CRYPTO_zalloc`
  2537.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2538.   
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2540.           goto err;
  2541.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2539:10: assigned
  2537.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
  2538.   
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2540.           goto err;
  2541.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2792:5: when calling `CRYPTO_free` here
  2790.       BIO_free_all(c_bio);
  2791.       BIO_free_all(s_bio);
  2792.       OPENSSL_free(cbuf);
              ^
  2793.       OPENSSL_free(sbuf);
  2794.   

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
    251.   }
    252.   
    253. > void CRYPTO_free(void *str, const char *file, int line)
    254.   {
    255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: was invalidated by call to `free()`
    267.       }
    268.   #else
    269.       free(str);
               ^
    270.   #endif
    271.   }

test/ssltest_old.c:2537:14: use-after-lifetime part of the trace starts here
2535.       int err_in_server = 0;
2536.   
2537.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                     ^
2538.   
2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2537:14: assigned
  2535.       int err_in_server = 0;
  2536.   
  2537.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
                       ^
  2538.   
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2537:5: assigned
  2535.       int err_in_server = 0;
  2536.   
  2537.       bufsiz = count > 40 * 1024 ? 40 * 1024 : count;
              ^
  2538.   
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)

test/ssltest_old.c:2541:17: passed as argument to `CRYPTO_zalloc`
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2540.           goto err;
  2541.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2542.           goto err;
  2543.   

test/ssltest_old.c:2541:17: return from call to `CRYPTO_zalloc`
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2540.           goto err;
  2541.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                          ^
  2542.           goto err;
  2543.   

test/ssltest_old.c:2541:10: assigned
  2539.       if ((cbuf = OPENSSL_zalloc(bufsiz)) == NULL)
  2540.           goto err;
  2541.       if ((sbuf = OPENSSL_zalloc(bufsiz)) == NULL)
                   ^
  2542.           goto err;
  2543.   

test/ssltest_old.c:2793:5: when calling `CRYPTO_free` here
  2791.       BIO_free_all(s_bio);
  2792.       OPENSSL_free(cbuf);
  2793.       OPENSSL_free(sbuf);
              ^
  2794.   
  2795.       if (should_negotiate != NULL && strcmp(should_negotiate, "fail-client") == 0)

crypto/mem.c:253:1: parameter `str` of CRYPTO_free
    251.   }
    252.   
    253. > void CRYPTO_free(void *str, const char *file, int line)
    254.   {
    255.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:269:5: invalid access occurs here
    267.       }
    268.   #else
    269.       free(str);
               ^
    270.   #endif
    271.   }
