crypto/x509v3/v3_pci.c:151: error: USE_AFTER_FREE
  call to `CRYPTO_free()` eventually accesses memory that was invalidated by call to `free()` on line 137 indirectly during the call to `CRYPTO_realloc()`.
Showing all 12 steps of the trace


crypto/x509v3/v3_pci.c:84:1: invalidation part of the trace starts here
82.   }
83.   
84. > static int process_pci_value(CONF_VALUE *val,
85.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
86.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:84:1: parameter `policy` of process_pci_value
  82.   }
  83.   
  84. > static int process_pci_value(CONF_VALUE *val,
  85.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  86.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:137:24: when calling `CRYPTO_realloc` here
  135.               }
  136.   
  137.               tmp_data = OPENSSL_realloc((*policy)->data,
                                ^
  138.                                          (*policy)->length + val_len + 1);
  139.               if (tmp_data) {

crypto/mem.c:238:1: parameter `str` of CRYPTO_realloc
    236.   }
    237.   
    238. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    239.   {
    240.       INCREMENT(realloc_count);

crypto/mem.c:249:9: when calling `CRYPTO_free` here
    247.   
    248.       if (num == 0) {
    249.           CRYPTO_free(str, file, line);
                   ^
    250.           return NULL;
    251.       }

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:312:5: was invalidated by call to `free()`
      310.       }
      311.   #else
      312.       free(str);
                 ^
      313.   #endif
      314.   }

crypto/x509v3/v3_pci.c:84:1: use-after-lifetime part of the trace starts here
82.   }
83.   
84. > static int process_pci_value(CONF_VALUE *val,
85.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
86.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:84:1: parameter `policy` of process_pci_value
  82.   }
  83.   
  84. > static int process_pci_value(CONF_VALUE *val,
  85.                                ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
  86.                                ASN1_OCTET_STRING **policy)

crypto/x509v3/v3_pci.c:151:17: when calling `CRYPTO_free` here
  149.                    * too!
  150.                    */
  151.                   OPENSSL_free((*policy)->data);
                         ^
  152.                   (*policy)->data = NULL;
  153.                   (*policy)->length = 0;

crypto/mem.c:295:1: parameter `str` of CRYPTO_free
    293.   }
    294.   
    295. > void CRYPTO_free(void *str, const char *file, int line)
    296.   {
    297.       INCREMENT(free_count);

crypto/mem.c:312:5: invalid access occurs here
    310.       }
    311.   #else
    312.       free(str);
               ^
    313.   #endif
    314.   }
