crypto/lock.c:491: error: USE_AFTER_FREE
  call to `CRYPTO_lock()` eventually accesses memory that was invalidated by call to `free()` on line 477 indirectly during the call to `CRYPTO_lock()`.
Showing all 22 steps of the trace


crypto/lock.c:477:9: invalidation part of the trace starts here
475.   #endif
476.       } else {
477.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
               ^
478.   
479.           ret = *pointer + amount;

crypto/lock.c:477:9: global variable `dyn_locks` accessed here
  475.   #endif
  476.       } else {
  477.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
                 ^
  478.   
  479.           ret = *pointer + amount;

crypto/lock.c:477:9: when calling `CRYPTO_lock` here
  475.   #endif
  476.       } else {
  477.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
                 ^
  478.   
  479.           ret = *pointer + amount;

crypto/lock.c:444:19: global variable `dyn_locks` accessed here
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer
    444.                   = CRYPTO_get_dynlock_value(type);
                             ^
    445.   
    446.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:450:13: when calling `CRYPTO_destroy_dynlockid` here
    448.               dynlock_lock_callback(mode, pointer, file, line);
    449.   
    450.               CRYPTO_destroy_dynlockid(type);
                       ^
    451.           }
    452.       } else if (locking_callback != NULL)

crypto/lock.c:301:9: global variable `dyn_locks` accessed here
      299.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      300.   
      301.       if (dyn_locks == NULL || i >= sk_CRYPTO_dynlock_num(dyn_locks)) {
                     ^
      302.           CRYPTO_w_unlock(CRYPTO_LOCK_DYNLOCK);
      303.           return;

crypto/lock.c:305:15: passed as argument to `sk_CRYPTO_dynlock_value`
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:305:15: return from call to `sk_CRYPTO_dynlock_value`
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                           ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:305:5: assigned
      303.           return;
      304.       }
      305.       pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                 ^
      306.       if (pointer != NULL) {
      307.           --pointer->references;

crypto/lock.c:323:9: when calling `CRYPTO_free` here
      321.       if (pointer) {
      322.           dynlock_destroy_callback(pointer->data, __FILE__, __LINE__);
      323.           OPENSSL_free(pointer);
                     ^
      324.       }
      325.   }

crypto/mem.c:234:1: parameter `str` of CRYPTO_free
        232.   }
        233.   
        234. > void CRYPTO_free(void *str)
        235.   {
        236.   #ifdef CRYPTO_MDEBUG

crypto/mem.c:245:5: was invalidated by call to `free()`
        243.       }
        244.   #else
        245.       free(str);
                   ^
        246.   #endif
        247.   }

crypto/lock.c:477:9: use-after-lifetime part of the trace starts here
475.   #endif
476.       } else {
477.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
               ^
478.   
479.           ret = *pointer + amount;

crypto/lock.c:477:9: global variable `dyn_locks` accessed here
  475.   #endif
  476.       } else {
  477.           CRYPTO_lock(CRYPTO_LOCK | CRYPTO_WRITE, type, file, line);
                 ^
  478.   
  479.           ret = *pointer + amount;

crypto/lock.c:491:9: when calling `CRYPTO_lock` here
  489.   #endif
  490.           *pointer = ret;
  491.           CRYPTO_lock(CRYPTO_UNLOCK | CRYPTO_WRITE, type, file, line);
                 ^
  492.       }
  493.       return (ret);

crypto/lock.c:444:19: global variable `dyn_locks` accessed here
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer
    444.                   = CRYPTO_get_dynlock_value(type);
                             ^
    445.   
    446.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:444:19: when calling `CRYPTO_get_dynlock_value` here
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer
    444.                   = CRYPTO_get_dynlock_value(type);
                             ^
    445.   
    446.               OPENSSL_assert(pointer != NULL);

crypto/lock.c:335:9: global variable `dyn_locks` accessed here
      333.       CRYPTO_w_lock(CRYPTO_LOCK_DYNLOCK);
      334.   
      335.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
                     ^
      336.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
      337.       if (pointer)

crypto/lock.c:336:19: passed as argument to `sk_CRYPTO_dynlock_value`
      334.   
      335.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      336.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                               ^
      337.       if (pointer)
      338.           pointer->references++;

crypto/lock.c:336:19: return from call to `sk_CRYPTO_dynlock_value`
      334.   
      335.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      336.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                               ^
      337.       if (pointer)
      338.           pointer->references++;

crypto/lock.c:336:9: assigned
      334.   
      335.       if (dyn_locks != NULL && i < sk_CRYPTO_dynlock_num(dyn_locks))
      336.           pointer = sk_CRYPTO_dynlock_value(dyn_locks, i);
                     ^
      337.       if (pointer)
      338.           pointer->references++;

crypto/lock.c:343:16: invalid access occurs here
      341.   
      342.       if (pointer)
      343.           return pointer->data;
                            ^
      344.       return NULL;
      345.   }
