Language: C
Label: vulnerable
CWE: CWE-416 \u2014 Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Code:
static pj_status_t ssl_match_fingerprint(dtls_srtp *ds, unsigned idx)
{
    X509 *rem_cert;
    pj_bool_t is_sha256;
    char buf[128];
    pj_size_t buf_len = sizeof(buf);
    pj_status_t status;

    /* Check hash algo, currently we only support SHA-256 & SHA-1 */
    if (!pj_strnicmp2(&ds->rem_fingerprint, "SHA-256 ", 8))
        is_sha256 = PJ_TRUE;
    else if (!pj_strnicmp2(&ds->rem_fingerprint, "SHA-1 ", 6))
        is_sha256 = PJ_FALSE;
    else {
        PJ_LOG(4,(ds->base.name, "Hash algo specified in remote SDP for "
                  "its DTLS certificate fingerprint is not supported"));
        return PJ_ENOTSUP;
    }

    pj_lock_acquire(ds->ossl_lock);
    if (!ds->ossl_ssl[idx]) {
        pj_lock_release(ds->ossl_lock);
        return PJ_EGONE;
    }

    /* Get remote cert & calculate the hash */
    rem_cert = SSL_get_peer_certificate(ds->ossl_ssl[idx]);

    pj_lock_release(ds->ossl_lock);

    if (!rem_cert)
        return PJMEDIA_SRTP_DTLS_EPEERNOCERT;

    status = ssl_get_fingerprint(rem_cert, is_sha256, buf, &buf_len);
    X509_free(rem_cert);
    if (status != PJ_SUCCESS)
        return status;

    /* Do they match? */
    if (pj_stricmp2(&ds->rem_fingerprint, buf))
        return PJMEDIA_SRTP_DTLS_EFPNOTMATCH;

    return PJ_SUCCESS;
}