Language: C
Label: safe
CWE: CWE-416 \u2014 Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Code:
ssl3_free(SSL *s)
{
	if (s == NULL)
		return;

	tls1_cleanup_key_block(s);
	ssl3_release_read_buffer(s);
	ssl3_release_write_buffer(s);

	tls_content_free(s->s3->rcontent);

	tls_buffer_free(s->s3->alert_fragment);
	tls_buffer_free(s->s3->handshake_fragment);

	freezero(s->s3->hs.sigalgs, s->s3->hs.sigalgs_len);
	sk_X509_pop_free(s->s3->hs.peer_certs, X509_free);
	sk_X509_pop_free(s->s3->hs.peer_certs_no_leaf, X509_free);
	tls_key_share_free(s->s3->hs.key_share);

	tls13_secrets_destroy(s->s3->hs.tls13.secrets);
	freezero(s->s3->hs.tls13.cookie, s->s3->hs.tls13.cookie_len);
	tls13_clienthello_hash_clear(&s->s3->hs.tls13);

	tls_buffer_free(s->s3->hs.tls13.quic_read_buffer);

	sk_X509_NAME_pop_free(s->s3->hs.tls12.ca_names, X509_NAME_free);
	sk_X509_pop_free(s->verified_chain, X509_free);
	s->verified_chain = NULL;

	tls1_transcript_free(s);
	tls1_transcript_hash_free(s);

	free(s->s3->alpn_selected);

	freezero(s->s3->peer_quic_transport_params,
	    s->s3->peer_quic_transport_params_len);

	freezero(s->s3, sizeof(*s->s3));

	s->s3 = NULL;
}