crypto/ct/ct_oct.c:395: error: USE_AFTER_FREE
  call to `SCT_free()` eventually accesses memory that was invalidated by call to `free()` on line 395 indirectly during the call to `SCT_free()`.
Showing all 22 steps of the trace


crypto/ct/ct_oct.c:368:1: invalidation part of the trace starts here
366.   }
367.   
368. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
369.                               size_t len)
370.   {

crypto/ct/ct_oct.c:368:1: parameter `a` of o2i_SCT_LIST
  366.   }
  367.   
  368. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
  369.                               size_t len)
  370.   {

crypto/ct/ct_oct.c:393:9: assigned
  391.   
  392.           /* Use the given stack, but empty it first. */
  393.           sk = *a;
                 ^
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
  395.               SCT_free(sct);

crypto/ct/ct_oct.c:394:23: passed as argument to `sk_SCT_pop`
  392.           /* Use the given stack, but empty it first. */
  393.           sk = *a;
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  395.               SCT_free(sct);
  396.       }

crypto/ct/ct_oct.c:394:23: return from call to `sk_SCT_pop`
  392.           /* Use the given stack, but empty it first. */
  393.           sk = *a;
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  395.               SCT_free(sct);
  396.       }

crypto/ct/ct_oct.c:394:17: assigned
  392.           /* Use the given stack, but empty it first. */
  393.           sk = *a;
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
                         ^
  395.               SCT_free(sct);
  396.       }

crypto/ct/ct_oct.c:395:13: when calling `SCT_free` here
  393.           sk = *a;
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
  395.               SCT_free(sct);
                     ^
  396.       }
  397.   

crypto/ct/ct_lib.c:78:1: parameter `sct` of SCT_free
    76.   }
    77.   
    78. > void SCT_free(SCT *sct)
    79.   {
    80.       if (sct != NULL) {

crypto/ct/ct_lib.c:82:9: when calling `CRYPTO_free` here
    80.       if (sct != NULL) {
    81.           OPENSSL_free(sct->log_id);
    82.           OPENSSL_free(sct->ext);
                  ^
    83.           OPENSSL_free(sct->sig);
    84.           OPENSSL_free(sct->sct);

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
      208.   }
      209.   
      210. > void CRYPTO_free(void *str, const char *file, int line)
      211.   {
      212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: was invalidated by call to `free()`
      224.       }
      225.   #else
      226.       free(str);
                 ^
      227.   #endif
      228.   }

crypto/ct/ct_oct.c:368:1: use-after-lifetime part of the trace starts here
366.   }
367.   
368. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
369.                               size_t len)
370.   {

crypto/ct/ct_oct.c:368:1: parameter `a` of o2i_SCT_LIST
  366.   }
  367.   
  368. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
  369.                               size_t len)
  370.   {

crypto/ct/ct_oct.c:393:9: assigned
  391.   
  392.           /* Use the given stack, but empty it first. */
  393.           sk = *a;
                 ^
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
  395.               SCT_free(sct);

crypto/ct/ct_oct.c:394:23: passed as argument to `sk_SCT_pop`
  392.           /* Use the given stack, but empty it first. */
  393.           sk = *a;
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  395.               SCT_free(sct);
  396.       }

crypto/ct/ct_oct.c:394:23: return from call to `sk_SCT_pop`
  392.           /* Use the given stack, but empty it first. */
  393.           sk = *a;
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
                               ^
  395.               SCT_free(sct);
  396.       }

crypto/ct/ct_oct.c:394:17: assigned
  392.           /* Use the given stack, but empty it first. */
  393.           sk = *a;
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
                         ^
  395.               SCT_free(sct);
  396.       }

crypto/ct/ct_oct.c:395:13: when calling `SCT_free` here
  393.           sk = *a;
  394.           while ((sct = sk_SCT_pop(sk)) != NULL)
  395.               SCT_free(sct);
                     ^
  396.       }
  397.   

crypto/ct/ct_lib.c:78:1: parameter `sct` of SCT_free
    76.   }
    77.   
    78. > void SCT_free(SCT *sct)
    79.   {
    80.       if (sct != NULL) {

crypto/ct/ct_lib.c:82:9: when calling `CRYPTO_free` here
    80.       if (sct != NULL) {
    81.           OPENSSL_free(sct->log_id);
    82.           OPENSSL_free(sct->ext);
                  ^
    83.           OPENSSL_free(sct->sig);
    84.           OPENSSL_free(sct->sct);

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
      208.   }
      209.   
      210. > void CRYPTO_free(void *str, const char *file, int line)
      211.   {
      212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: invalid access occurs here
      224.       }
      225.   #else
      226.       free(str);
                 ^
      227.   #endif
      228.   }
