crypto/stack/stack.c:215: error: USE_AFTER_FREE
  call to `OPENSSL_sk_free()` eventually accesses memory that was invalidated by call to `free()` on line 214 indirectly during the call to `sk_reserve()`.
Showing all 20 steps of the trace


crypto/stack/stack.c:204:25: invalidation part of the trace starts here
202.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
203.   {
204.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                               ^
205.   
206.       if (st == NULL)

crypto/stack/stack.c:204:25: passed as argument to `CRYPTO_zalloc`
  202.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  203.   {
  204.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  205.   
  206.       if (st == NULL)

crypto/stack/stack.c:204:25: return from call to `CRYPTO_zalloc`
  202.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  203.   {
  204.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  205.   
  206.       if (st == NULL)

crypto/stack/stack.c:204:5: assigned
  202.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  203.   {
  204.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
             ^
  205.   
  206.       if (st == NULL)

crypto/stack/stack.c:214:10: when calling `sk_reserve` here
  212.           return st;
  213.   
  214.       if (!sk_reserve(st, n, 1)) {
                  ^
  215.           OPENSSL_sk_free(st);
  216.           return NULL;

crypto/stack/stack.c:156:1: parameter `st` of sk_reserve
    154.   
    155.   /* internal STACK storage allocation */
    156. > static int sk_reserve(OPENSSL_STACK *st, int n, int exact)
    157.   {
    158.       const void **tmpdata;

crypto/stack/stack.c:193:15: when calling `CRYPTO_realloc` here
    191.       }
    192.   
    193.       tmpdata = OPENSSL_realloc((void *)st->data, sizeof(void *) * num_alloc);
                         ^
    194.       if (tmpdata == NULL)
    195.           return 0;

crypto/mem.c:228:1: parameter `str` of CRYPTO_realloc
      226.   }
      227.   
      228. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
      229.   {
      230.       INCREMENT(realloc_count);

crypto/mem.c:239:9: when calling `CRYPTO_free` here
      237.   
      238.       if (num == 0) {
      239.           CRYPTO_free(str, file, line);
                     ^
      240.           return NULL;
      241.       }

crypto/mem.c:286:1: parameter `str` of CRYPTO_free
        284.   }
        285.   
        286. > void CRYPTO_free(void *str, const char *file, int line)
        287.   {
        288.       INCREMENT(free_count);

crypto/mem.c:303:5: was invalidated by call to `free()`
        301.       }
        302.   #else
        303.       free(str);
                   ^
        304.   #endif
        305.   }

crypto/stack/stack.c:204:25: use-after-lifetime part of the trace starts here
202.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
203.   {
204.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                               ^
205.   
206.       if (st == NULL)

crypto/stack/stack.c:204:25: passed as argument to `CRYPTO_zalloc`
  202.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  203.   {
  204.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  205.   
  206.       if (st == NULL)

crypto/stack/stack.c:204:25: return from call to `CRYPTO_zalloc`
  202.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  203.   {
  204.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
                                 ^
  205.   
  206.       if (st == NULL)

crypto/stack/stack.c:204:5: assigned
  202.   OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n)
  203.   {
  204.       OPENSSL_STACK *st = OPENSSL_zalloc(sizeof(OPENSSL_STACK));
             ^
  205.   
  206.       if (st == NULL)

crypto/stack/stack.c:215:9: when calling `OPENSSL_sk_free` here
  213.   
  214.       if (!sk_reserve(st, n, 1)) {
  215.           OPENSSL_sk_free(st);
                 ^
  216.           return NULL;
  217.       }

crypto/stack/stack.c:367:1: parameter `st` of OPENSSL_sk_free
    365.   }
    366.   
    367. > void OPENSSL_sk_free(OPENSSL_STACK *st)
    368.   {
    369.       if (st == NULL)

crypto/stack/stack.c:371:5: when calling `CRYPTO_free` here
    369.       if (st == NULL)
    370.           return;
    371.       OPENSSL_free(st->data);
               ^
    372.       OPENSSL_free(st);
    373.   }

crypto/mem.c:286:1: parameter `str` of CRYPTO_free
      284.   }
      285.   
      286. > void CRYPTO_free(void *str, const char *file, int line)
      287.   {
      288.       INCREMENT(free_count);

crypto/mem.c:303:5: invalid access occurs here
      301.       }
      302.   #else
      303.       free(str);
                 ^
      304.   #endif
      305.   }
