ssl/statem/statem_lib.c:2271: error: USE_AFTER_FREE
  call to `sk_X509_NAME_pop_free()` eventually accesses memory that was invalidated by call to `free()` on line 2257 indirectly during the call to `sk_X509_NAME_push()`.
Showing all 24 steps of the trace


ssl/statem/statem_lib.c:2218:34: invalidation part of the trace starts here
2216.   int parse_ca_names(SSL *s, PACKET *pkt)
2217.   {
2218.       STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
                                         ^
2219.       X509_NAME *xn = NULL;
2220.       PACKET cadns;

ssl/statem/statem_lib.c:2218:34: passed as argument to `sk_X509_NAME_new`
  2216.   int parse_ca_names(SSL *s, PACKET *pkt)
  2217.   {
  2218.       STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
                                           ^
  2219.       X509_NAME *xn = NULL;
  2220.       PACKET cadns;

ssl/statem/statem_lib.c:2218:34: return from call to `sk_X509_NAME_new`
  2216.   int parse_ca_names(SSL *s, PACKET *pkt)
  2217.   {
  2218.       STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
                                           ^
  2219.       X509_NAME *xn = NULL;
  2220.       PACKET cadns;

ssl/statem/statem_lib.c:2218:5: assigned
  2216.   int parse_ca_names(SSL *s, PACKET *pkt)
  2217.   {
  2218.       STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
              ^
  2219.       X509_NAME *xn = NULL;
  2220.       PACKET cadns;

ssl/statem/statem_lib.c:2257:14: when calling `sk_X509_NAME_push` here
  2255.           }
  2256.   
  2257.           if (!sk_X509_NAME_push(ca_sk, xn)) {
                       ^
  2258.               SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_PARSE_CA_NAMES,
  2259.                        ERR_R_MALLOC_FAILURE);

include/openssl/x509.h:77:1: parameter `sk` of sk_X509_NAME_push
    75.   DEFINE_STACK_OF(X509_NAME_ENTRY)
    76.   
    77. > DEFINE_STACK_OF(X509_NAME)
    78.   
    79.   # define X509_EX_V_NETSCAPE_HACK         0x8000

include/openssl/x509.h:77:1: when calling `OPENSSL_sk_push` here
    75.   DEFINE_STACK_OF(X509_NAME_ENTRY)
    76.   
    77. > DEFINE_STACK_OF(X509_NAME)
    78.   
    79.   # define X509_EX_V_NETSCAPE_HACK         0x8000

crypto/stack/stack.c:325:1: parameter `st` of OPENSSL_sk_push
      323.   }
      324.   
      325. > int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data)
      326.   {
      327.       if (st == NULL)

crypto/stack/stack.c:329:12: when calling `OPENSSL_sk_insert` here
      327.       if (st == NULL)
      328.           return -1;
      329.       return OPENSSL_sk_insert(st, data, st->num);
                        ^
      330.   }
      331.   

crypto/stack/stack.c:236:1: parameter `st` of OPENSSL_sk_insert
        234.   }
        235.   
        236. > int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)
        237.   {
        238.       if (st == NULL || st->num == max_nodes)

crypto/stack/stack.c:241:10: when calling `sk_reserve` here
        239.           return 0;
        240.   
        241.       if (!sk_reserve(st, 1, 0))
                        ^
        242.           return 0;
        243.   

crypto/stack/stack.c:159:1: parameter `st` of sk_reserve
          157.   
          158.   /* internal STACK storage allocation */
          159. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
          160.   {
          161.       const void **tmpdata;

crypto/stack/stack.c:197:15: when calling `CRYPTO_realloc` here
          195.       }
          196.   
          197.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                               ^
          198.       if (tmpdata == NULL)
          199.           return 0;

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
            236.   }
            237.   
            238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
            239.   {
            240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
            247.   
            248.       if (num == 0) {
            249.           CRYPTO_free(str, file, line);
                           ^
            250.           return NULL;
            251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
              293.   }
              294.   
              295. > void CRYPTO_free(void *str, const char *file, int line)
              296.   {
              297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
              310.       }
              311.   #else
              312.       free(str);
                         ^
              313.   #endif
              314.   }

ssl/statem/statem_lib.c:2218:34: use-after-lifetime part of the trace starts here
2216.   int parse_ca_names(SSL *s, PACKET *pkt)
2217.   {
2218.       STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
                                         ^
2219.       X509_NAME *xn = NULL;
2220.       PACKET cadns;

ssl/statem/statem_lib.c:2218:34: passed as argument to `sk_X509_NAME_new`
  2216.   int parse_ca_names(SSL *s, PACKET *pkt)
  2217.   {
  2218.       STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
                                           ^
  2219.       X509_NAME *xn = NULL;
  2220.       PACKET cadns;

ssl/statem/statem_lib.c:2218:34: return from call to `sk_X509_NAME_new`
  2216.   int parse_ca_names(SSL *s, PACKET *pkt)
  2217.   {
  2218.       STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
                                           ^
  2219.       X509_NAME *xn = NULL;
  2220.       PACKET cadns;

ssl/statem/statem_lib.c:2218:5: assigned
  2216.   int parse_ca_names(SSL *s, PACKET *pkt)
  2217.   {
  2218.       STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
              ^
  2219.       X509_NAME *xn = NULL;
  2220.       PACKET cadns;

ssl/statem/statem_lib.c:2271:5: when calling `sk_X509_NAME_pop_free` here
  2269.   
  2270.    err:
  2271.       sk_X509_NAME_pop_free(ca_sk, X509_NAME_free);
              ^
  2272.       X509_NAME_free(xn);
  2273.       return 0;

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }
