crypto/x509v3/v3_pci.c:143: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 129 indirectly during the call to `CRYPTO_realloc()`.
Showing all 12 steps of the trace


crypto/x509v3/v3_pci.c:76:1: invalidation part of the trace starts here
74.   }
75.   
76. > static int process_pci_value(CONF_VALUE *val,
77.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
78.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:76:1: parameter `policy` of process_pci_value
  74.   }
  75.   
  76. > static int process_pci_value(CONF_VALUE *val,
  77.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  78.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:129:24: when calling `CRYPTO_realloc` here
  127.               }
  128.   
  129.               tmp_data = OPENSSL_realloc((*policy)->data,
                                ^
  130.                                          (*policy)->length + val_len + 1);
  131.               if (tmp_data) {

crypto/mem.c:155:1: parameter `str` of CRYPTO_realloc
    153.   }
    154.   
    155. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    156.   {
    157.       if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)

crypto/mem.c:164:9: when calling `CRYPTO_free` here
    162.   
    163.       if (num == 0) {
    164.           CRYPTO_free(str, file, line);
                   ^
    165.           return NULL;
    166.       }

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
      208.   }
      209.   
      210. > void CRYPTO_free(void *str, const char *file, int line)
      211.   {
      212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: was invalidated by call to `free()`
      224.       }
      225.   #else
      226.       free(str);
                 ^
      227.   #endif
      228.   }

crypto/x509v3/v3_pci.c:76:1: use-after-lifetime part of the trace starts here
74.   }
75.   
76. > static int process_pci_value(CONF_VALUE *val,
77.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
78.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:76:1: parameter `policy` of process_pci_value
  74.   }
  75.   
  76. > static int process_pci_value(CONF_VALUE *val,
  77.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  78.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:143:17: when calling `CRYPTO_free` here
  141.                    * too!
  142.                    */
  143.                   OPENSSL_free((*policy)->data);
                         ^
  144.                   (*policy)->data = NULL;
  145.                   (*policy)->length = 0;

crypto/mem.c:210:1: parameter `str` of CRYPTO_free
    208.   }
    209.   
    210. > void CRYPTO_free(void *str, const char *file, int line)
    211.   {
    212.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:226:5: invalid access occurs here
    224.       }
    225.   #else
    226.       free(str);
               ^
    227.   #endif
    228.   }
