crypto/conf/conf_mod.c:390: error: USE_AFTER_FREE
  call to `module_finish()` eventually accesses memory that was invalidated by call to `free()` on line 390 indirectly during the call to `module_finish()`.
Showing all 40 steps of the trace


crypto/conf/conf_mod.c:388:32: invalidation part of the trace starts here
386.   {
387.       CONF_IMODULE *imod;
388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
                                      ^
389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
390.           module_finish(imod);

crypto/conf/conf_mod.c:388:32: global variable `initialized_modules` accessed here
  386.   {
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
                                        ^
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
  390.           module_finish(imod);

crypto/conf/conf_mod.c:389:16: passed as argument to `sk_CONF_IMODULE_pop`
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  390.           module_finish(imod);
  391.       }

include/openssl/conf.h:57:1: parameter `sk` of sk_CONF_IMODULE_pop
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

include/openssl/conf.h:57:1: passed as argument to `OPENSSL_sk_pop`
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

crypto/stack/stack.c:231:1: parameter `st` of OPENSSL_sk_pop
      229.   }
      230.   
      231. > void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      232.   {
      233.       if (st == NULL)

crypto/stack/stack.c:237:13: passed as argument to `OPENSSL_sk_delete`
      235.       if (st->num <= 0)
      236.           return (NULL);
      237.       return (OPENSSL_sk_delete(st, st->num - 1));
                         ^
      238.   }
      239.   

crypto/stack/stack.c:155:1: parameter `st` of OPENSSL_sk_delete
        153.   }
        154.   
        155. > void *OPENSSL_sk_delete(OPENSSL_STACK *st, int loc)
        156.   {
        157.       char *ret;

crypto/stack/stack.c:167:13: assigned
        165.           j = st->num - 1;
        166.           for (i = loc; i < j; i++)
        167.               st->data[i] = st->data[i + 1];
                           ^
        168.           /*
        169.            * In theory memcpy is not safe for this memcpy( &(st->data[loc]),

crypto/stack/stack.c:237:13: return from call to `OPENSSL_sk_delete`
      235.       if (st->num <= 0)
      236.           return (NULL);
      237.       return (OPENSSL_sk_delete(st, st->num - 1));
                         ^
      238.   }
      239.   

include/openssl/conf.h:57:1: return from call to `OPENSSL_sk_pop`
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

crypto/conf/conf_mod.c:389:16: return from call to `sk_CONF_IMODULE_pop`
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  390.           module_finish(imod);
  391.       }

crypto/conf/conf_mod.c:389:16: passed as argument to `sk_CONF_IMODULE_pop`
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  390.           module_finish(imod);
  391.       }

crypto/conf/conf_mod.c:389:16: return from call to `sk_CONF_IMODULE_pop`
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  390.           module_finish(imod);
  391.       }

crypto/conf/conf_mod.c:389:9: assigned
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                 ^
  390.           module_finish(imod);
  391.       }

crypto/conf/conf_mod.c:390:9: when calling `module_finish` here
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
  390.           module_finish(imod);
                 ^
  391.       }
  392.       sk_CONF_IMODULE_free(initialized_modules);

crypto/conf/conf_mod.c:398:1: parameter `imod` of module_finish
    396.   /* finish a module instance */
    397.   
    398. > static void module_finish(CONF_IMODULE *imod)
    399.   {
    400.       if (!imod)

crypto/conf/conf_mod.c:407:5: when calling `CRYPTO_free` here
    405.       OPENSSL_free(imod->name);
    406.       OPENSSL_free(imod->value);
    407.       OPENSSL_free(imod);
               ^
    408.   }
    409.   

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
      161.   }
      162.   
      163. > void CRYPTO_free(void *str, const char *file, int line)
      164.   {
      165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: was invalidated by call to `free()`
      177.       }
      178.   #else
      179.       free(str);
                 ^
      180.   #endif
      181.   }

crypto/conf/conf_mod.c:388:32: use-after-lifetime part of the trace starts here
386.   {
387.       CONF_IMODULE *imod;
388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
                                      ^
389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
390.           module_finish(imod);

crypto/conf/conf_mod.c:388:32: global variable `initialized_modules` accessed here
  386.   {
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
                                        ^
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
  390.           module_finish(imod);

crypto/conf/conf_mod.c:389:16: passed as argument to `sk_CONF_IMODULE_pop`
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  390.           module_finish(imod);
  391.       }

include/openssl/conf.h:57:1: parameter `sk` of sk_CONF_IMODULE_pop
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

include/openssl/conf.h:57:1: passed as argument to `OPENSSL_sk_pop`
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

crypto/stack/stack.c:231:1: parameter `st` of OPENSSL_sk_pop
      229.   }
      230.   
      231. > void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      232.   {
      233.       if (st == NULL)

crypto/stack/stack.c:237:13: passed as argument to `OPENSSL_sk_delete`
      235.       if (st->num <= 0)
      236.           return (NULL);
      237.       return (OPENSSL_sk_delete(st, st->num - 1));
                         ^
      238.   }
      239.   

crypto/stack/stack.c:155:1: parameter `st` of OPENSSL_sk_delete
        153.   }
        154.   
        155. > void *OPENSSL_sk_delete(OPENSSL_STACK *st, int loc)
        156.   {
        157.       char *ret;

crypto/stack/stack.c:167:13: assigned
        165.           j = st->num - 1;
        166.           for (i = loc; i < j; i++)
        167.               st->data[i] = st->data[i + 1];
                           ^
        168.           /*
        169.            * In theory memcpy is not safe for this memcpy( &(st->data[loc]),

crypto/stack/stack.c:237:13: return from call to `OPENSSL_sk_delete`
      235.       if (st->num <= 0)
      236.           return (NULL);
      237.       return (OPENSSL_sk_delete(st, st->num - 1));
                         ^
      238.   }
      239.   

include/openssl/conf.h:57:1: return from call to `OPENSSL_sk_pop`
    55.   
    56.   DEFINE_STACK_OF(CONF_MODULE)
    57. > DEFINE_STACK_OF(CONF_IMODULE)
    58.   
    59.   /* DSO module function typedefs */

crypto/conf/conf_mod.c:389:16: return from call to `sk_CONF_IMODULE_pop`
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  390.           module_finish(imod);
  391.       }

crypto/conf/conf_mod.c:389:16: passed as argument to `sk_CONF_IMODULE_pop`
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  390.           module_finish(imod);
  391.       }

crypto/conf/conf_mod.c:389:16: return from call to `sk_CONF_IMODULE_pop`
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                        ^
  390.           module_finish(imod);
  391.       }

crypto/conf/conf_mod.c:389:9: assigned
  387.       CONF_IMODULE *imod;
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
                 ^
  390.           module_finish(imod);
  391.       }

crypto/conf/conf_mod.c:390:9: when calling `module_finish` here
  388.       while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
  389.           imod = sk_CONF_IMODULE_pop(initialized_modules);
  390.           module_finish(imod);
                 ^
  391.       }
  392.       sk_CONF_IMODULE_free(initialized_modules);

crypto/conf/conf_mod.c:398:1: parameter `imod` of module_finish
    396.   /* finish a module instance */
    397.   
    398. > static void module_finish(CONF_IMODULE *imod)
    399.   {
    400.       if (!imod)

crypto/conf/conf_mod.c:407:5: when calling `CRYPTO_free` here
    405.       OPENSSL_free(imod->name);
    406.       OPENSSL_free(imod->value);
    407.       OPENSSL_free(imod);
               ^
    408.   }
    409.   

crypto/mem.c:163:1: parameter `str` of CRYPTO_free
      161.   }
      162.   
      163. > void CRYPTO_free(void *str, const char *file, int line)
      164.   {
      165.       if (free_impl != NULL && free_impl != &CRYPTO_free) {

crypto/mem.c:179:5: invalid access occurs here
      177.       }
      178.   #else
      179.       free(str);
                 ^
      180.   #endif
      181.   }
