crypto/async/async.c:330: error: USE_AFTER_FREE
  call to `async_job_free()` eventually accesses memory that was invalidated by call to `free()` on line 330 indirectly during the call to `async_job_free()`.
Showing all 20 steps of the trace


crypto/async/async.c:321:1: invalidation part of the trace starts here
319.   }
320.   
321. > static void async_empty_pool(async_pool *pool)
322.   {
323.       ASYNC_JOB *job;

crypto/async/async.c:321:1: parameter `pool` of async_empty_pool
  319.   }
  320.   
  321. > static void async_empty_pool(async_pool *pool)
  322.   {
  323.       ASYNC_JOB *job;

crypto/async/async.c:329:15: passed as argument to `sk_ASYNC_JOB_pop`
  327.   
  328.       do {
  329.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  330.           async_job_free(job);
  331.       } while (job);

crypto/async/async.c:329:15: return from call to `sk_ASYNC_JOB_pop`
  327.   
  328.       do {
  329.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  330.           async_job_free(job);
  331.       } while (job);

crypto/async/async.c:329:9: assigned
  327.   
  328.       do {
  329.           job = sk_ASYNC_JOB_pop(pool->jobs);
                 ^
  330.           async_job_free(job);
  331.       } while (job);

crypto/async/async.c:330:9: when calling `async_job_free` here
  328.       do {
  329.           job = sk_ASYNC_JOB_pop(pool->jobs);
  330.           async_job_free(job);
                 ^
  331.       } while (job);
  332.   }

crypto/async/async.c:138:1: parameter `job` of async_job_free
    136.   }
    137.   
    138. > static void async_job_free(ASYNC_JOB *job)
    139.   {
    140.       if (job != NULL) {

crypto/async/async.c:145:9: when calling `CRYPTO_free` here
    143.           async_close_fd(job->wait_fd);
    144.           async_close_fd(job->wake_fd);
    145.           OPENSSL_free(job);
                   ^
    146.       }
    147.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: was invalidated by call to `free()`
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }

crypto/async/async.c:321:1: use-after-lifetime part of the trace starts here
319.   }
320.   
321. > static void async_empty_pool(async_pool *pool)
322.   {
323.       ASYNC_JOB *job;

crypto/async/async.c:321:1: parameter `pool` of async_empty_pool
  319.   }
  320.   
  321. > static void async_empty_pool(async_pool *pool)
  322.   {
  323.       ASYNC_JOB *job;

crypto/async/async.c:329:15: passed as argument to `sk_ASYNC_JOB_pop`
  327.   
  328.       do {
  329.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  330.           async_job_free(job);
  331.       } while (job);

crypto/async/async.c:329:15: return from call to `sk_ASYNC_JOB_pop`
  327.   
  328.       do {
  329.           job = sk_ASYNC_JOB_pop(pool->jobs);
                       ^
  330.           async_job_free(job);
  331.       } while (job);

crypto/async/async.c:329:9: assigned
  327.   
  328.       do {
  329.           job = sk_ASYNC_JOB_pop(pool->jobs);
                 ^
  330.           async_job_free(job);
  331.       } while (job);

crypto/async/async.c:330:9: when calling `async_job_free` here
  328.       do {
  329.           job = sk_ASYNC_JOB_pop(pool->jobs);
  330.           async_job_free(job);
                 ^
  331.       } while (job);
  332.   }

crypto/async/async.c:138:1: parameter `job` of async_job_free
    136.   }
    137.   
    138. > static void async_job_free(ASYNC_JOB *job)
    139.   {
    140.       if (job != NULL) {

crypto/async/async.c:145:9: when calling `CRYPTO_free` here
    143.           async_close_fd(job->wait_fd);
    144.           async_close_fd(job->wake_fd);
    145.           OPENSSL_free(job);
                   ^
    146.       }
    147.   }

crypto/mem.c:233:1: parameter `str` of CRYPTO_free
      231.   }
      232.   
      233. > void CRYPTO_free(void *str)
      234.   {
      235.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:244:5: invalid access occurs here
      242.       }
      243.   #else
      244.       free(str);
                 ^
      245.   #endif
      246.   }
