Language: C
Label: safe
CWE: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

Code:
static TEE_Result do_allocate_keypair(struct dsa_keypair *key, size_t l_bits,
				      size_t n_bits)
{
	DSA_TRACE("DSA allocate Keypair of L=%zu bits and N=%zu bits", l_bits,
		  n_bits);

	/* Initialize the key fields to NULL */
	memset(key, 0, sizeof(*key));

	/* Allocate Generator Scalar */
	key->g = crypto_bignum_allocate(l_bits);
	if (!key->g)
		goto err;

	/* Allocate Prime Number Modulus */
	key->p = crypto_bignum_allocate(l_bits);
	if (!key->p)
		goto err;

	/* Allocate Prime Number Modulus */
	key->q = crypto_bignum_allocate(n_bits);
	if (!key->q)
		goto err;

	/* Allocate Private key X */
	key->x = crypto_bignum_allocate(n_bits);
	if (!key->x)
		goto err;

	/* Allocate Public Key Y */
	key->y = crypto_bignum_allocate(l_bits);
	if (!key->y)
		goto err;

	return TEE_SUCCESS;

err:
	DSA_TRACE("Allocation error");

	crypto_bignum_free(&key->g);
	crypto_bignum_free(&key->p);
	crypto_bignum_free(&key->q);
	crypto_bignum_free(&key->x);

	return TEE_ERROR_OUT_OF_MEMORY;
}