crypto/asn1/x_name.c:185: error: USE_AFTER_FREE
  call to `X509_NAME_ENTRY_free()` eventually accesses memory that was invalidated by call to `free()` on line 185 indirectly during the call to `X509_NAME_ENTRY_free()`.
Showing all 16 steps of the trace


crypto/asn1/x_name.c:174:1: invalidation part of the trace starts here
172.   	}
173.   
174. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
175.   	{
176.   	int set=0,i;

crypto/asn1/x_name.c:174:1: parameter `a` of d2i_X509_NAME
  172.   	}
  173.   
  174. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  175.   	{
  176.   	int set=0,i;

crypto/asn1/x_name.c:179:2: assigned
  177.   	int idx=0;
  178.   	unsigned char *orig;
  179.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  180.   
  181.   	orig= *pp;

crypto/asn1/x_name.c:186:12: passed as argument to `sk_X509_NAME_ENTRY_pop`
  184.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free(
  186.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  187.   		}
  188.   

crypto/asn1/x_name.c:186:12: return from call to `sk_X509_NAME_ENTRY_pop`
  184.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free(
  186.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  187.   		}
  188.   

crypto/asn1/x_name.c:185:4: when calling `X509_NAME_ENTRY_free` here
  183.   		{
  184.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free(
            ^
  186.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
  187.   		}

crypto/asn1/x_name.c:251:1: parameter `a` of X509_NAME_ENTRY_free
    249.   	}
    250.   
    251. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    252.   	{
    253.   	if (a == NULL) return;

crypto/asn1/x_name.c:256:2: was invalidated by call to `free()`
    254.   	ASN1_OBJECT_free(a->object);
    255.   	ASN1_BIT_STRING_free(a->value);
    256.   	Free(a);
            ^
    257.   	}
    258.   

crypto/asn1/x_name.c:174:1: use-after-lifetime part of the trace starts here
172.   	}
173.   
174. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
175.   	{
176.   	int set=0,i;

crypto/asn1/x_name.c:174:1: parameter `a` of d2i_X509_NAME
  172.   	}
  173.   
  174. > X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length)
  175.   	{
  176.   	int set=0,i;

crypto/asn1/x_name.c:179:2: assigned
  177.   	int idx=0;
  178.   	unsigned char *orig;
  179.   	M_ASN1_D2I_vars(a,X509_NAME *,X509_NAME_new);
          ^
  180.   
  181.   	orig= *pp;

crypto/asn1/x_name.c:186:12: passed as argument to `sk_X509_NAME_ENTRY_pop`
  184.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free(
  186.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  187.   		}
  188.   

crypto/asn1/x_name.c:186:12: return from call to `sk_X509_NAME_ENTRY_pop`
  184.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free(
  186.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
                    ^
  187.   		}
  188.   

crypto/asn1/x_name.c:185:4: when calling `X509_NAME_ENTRY_free` here
  183.   		{
  184.   		while (sk_X509_NAME_ENTRY_num(ret->entries) > 0)
  185.   			X509_NAME_ENTRY_free(
            ^
  186.   				       sk_X509_NAME_ENTRY_pop(ret->entries));
  187.   		}

crypto/asn1/x_name.c:251:1: parameter `a` of X509_NAME_ENTRY_free
    249.   	}
    250.   
    251. > void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
    252.   	{
    253.   	if (a == NULL) return;

crypto/asn1/x_name.c:256:2: invalid access occurs here
    254.   	ASN1_OBJECT_free(a->object);
    255.   	ASN1_BIT_STRING_free(a->value);
    256.   	Free(a);
            ^
    257.   	}
    258.   
