crypto/txt_db/txt_db.c:165: error: USE_AFTER_FREE
  call to `BUF_MEM_free()` eventually accesses memory that was invalidated by call to `free()` on line 82 indirectly during the call to `BUF_MEM_grow()`.
Showing all 20 steps of the trace


crypto/txt_db/txt_db.c:80:16: invalidation part of the trace starts here
78.       BUF_MEM *buf = NULL;
79.   
80.       if ((buf = BUF_MEM_new()) == NULL)
                     ^
81.           goto err;
82.       if (!BUF_MEM_grow(buf, size))

crypto/txt_db/txt_db.c:80:16: passed as argument to `BUF_MEM_new`
  78.       BUF_MEM *buf = NULL;
  79.   
  80.       if ((buf = BUF_MEM_new()) == NULL)
                       ^
  81.           goto err;
  82.       if (!BUF_MEM_grow(buf, size))

crypto/txt_db/txt_db.c:80:16: return from call to `BUF_MEM_new`
  78.       BUF_MEM *buf = NULL;
  79.   
  80.       if ((buf = BUF_MEM_new()) == NULL)
                       ^
  81.           goto err;
  82.       if (!BUF_MEM_grow(buf, size))

crypto/txt_db/txt_db.c:80:10: assigned
  78.       BUF_MEM *buf = NULL;
  79.   
  80.       if ((buf = BUF_MEM_new()) == NULL)
                 ^
  81.           goto err;
  82.       if (!BUF_MEM_grow(buf, size))

crypto/txt_db/txt_db.c:82:10: when calling `BUF_MEM_grow` here
  80.       if ((buf = BUF_MEM_new()) == NULL)
  81.           goto err;
  82.       if (!BUF_MEM_grow(buf, size))
                 ^
  83.           goto err;
  84.   

crypto/buffer/buffer.c:121:1: parameter `str` of BUF_MEM_grow
    119.   }
    120.   
    121. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
    122.   {
    123.       char *ret;

crypto/buffer/buffer.c:142:15: when calling `sec_alloc_realloc` here
    140.       n = (len + 3) / 3 * 4;
    141.       if ((str->flags & BUF_MEM_FLAG_SECURE))
    142.           ret = sec_alloc_realloc(str, n);
                         ^
    143.       else
    144.           ret = OPENSSL_realloc(str->data, n);

crypto/buffer/buffer.c:108:1: parameter `str` of sec_alloc_realloc
      106.   /* Allocate a block of secure memory; copy over old data if there
      107.    * was any, and then free it. */
      108. > static char *sec_alloc_realloc(BUF_MEM *str, size_t len)
      109.   {
      110.       char *ret;

crypto/buffer/buffer.c:116:9: when calling `CRYPTO_secure_free` here
      114.           if (ret != NULL)
      115.               memcpy(ret, str->data, str->length);
      116.           OPENSSL_secure_free(str->data);
                     ^
      117.       }
      118.       return (ret);

crypto/mem_sec.c:123:1: parameter `ptr` of CRYPTO_secure_free
        121.   }
        122.   
        123. > void CRYPTO_secure_free(void *ptr)
        124.   {
        125.   #ifdef IMPLEMENTED

crypto/mem_sec.c:131:9: when calling `CRYPTO_free` here
        129.           return;
        130.       if (!secure_mem_initialized) {
        131.           CRYPTO_free(ptr);
                       ^
        132.           return;
        133.       }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
          231.   }
          232.   
          233. > void CRYPTO_free(void *str)
          234.   {
          235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
          242.       }
          243.   #else
          244.       free(str);
                     ^
          245.   #endif
          246.   }

crypto/txt_db/txt_db.c:80:16: use-after-lifetime part of the trace starts here
78.       BUF_MEM *buf = NULL;
79.   
80.       if ((buf = BUF_MEM_new()) == NULL)
                     ^
81.           goto err;
82.       if (!BUF_MEM_grow(buf, size))

crypto/txt_db/txt_db.c:80:16: passed as argument to `BUF_MEM_new`
  78.       BUF_MEM *buf = NULL;
  79.   
  80.       if ((buf = BUF_MEM_new()) == NULL)
                       ^
  81.           goto err;
  82.       if (!BUF_MEM_grow(buf, size))

crypto/txt_db/txt_db.c:80:16: return from call to `BUF_MEM_new`
  78.       BUF_MEM *buf = NULL;
  79.   
  80.       if ((buf = BUF_MEM_new()) == NULL)
                       ^
  81.           goto err;
  82.       if (!BUF_MEM_grow(buf, size))

crypto/txt_db/txt_db.c:80:10: assigned
  78.       BUF_MEM *buf = NULL;
  79.   
  80.       if ((buf = BUF_MEM_new()) == NULL)
                 ^
  81.           goto err;
  82.       if (!BUF_MEM_grow(buf, size))

crypto/txt_db/txt_db.c:165:5: when calling `BUF_MEM_free` here
  163.       return ret;
  164.    err:
  165.       BUF_MEM_free(buf);
             ^
  166.       if (ret != NULL) {
  167.           sk_OPENSSL_PSTRING_free(ret->data);

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
    231.   }
    232.   
    233. > void CRYPTO_free(void *str)
    234.   {
    235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
    242.       }
    243.   #else
    244.       free(str);
               ^
    245.   #endif
    246.   }
