Language: C
Label: vulnerable
CWE: CWE-416 \u2014 Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Code:
static pj_status_t ssl_on_recv_packet(dtls_srtp *ds, unsigned idx,
                                      const void *data, pj_size_t len)
{
    char tmp[128];
    pj_size_t nwritten;

    pj_lock_acquire(ds->ossl_lock);

    if (!ds->ossl_rbio[idx]) {
        pj_lock_release(ds->ossl_lock);
        return PJ_EGONE;
    }

    nwritten = BIO_write(ds->ossl_rbio[idx], data, (int)len);
    if (nwritten < len) {
        /* Error? */
        pj_status_t status;
        status = GET_SSL_STATUS(ds);
#if DTLS_DEBUG
        pj_perror(2, ds->base.name, status, "BIO_write() error");
#endif
        pj_lock_release(ds->ossl_lock);
        return status;
    }

    if (!ds->ossl_ssl[idx]) {
        pj_lock_release(ds->ossl_lock);
        return PJ_EGONE;
    }

    /* Consume (and ignore) the packet */
    while (1) {
        int rc = SSL_read(ds->ossl_ssl[idx], tmp, sizeof(tmp));
        if (rc <= 0) {
#if DTLS_DEBUG
            pj_status_t status = GET_SSL_STATUS(ds);
            if (status != PJ_SUCCESS)
                pj_perror(2, ds->base.name, status, "SSL_read() error");
#endif
            break;
        }
    }

    pj_lock_release(ds->ossl_lock);

    /* Flush anything pending in the write BIO */
    return ssl_flush_wbio(ds, idx);
}