gh-159739: Release SSL resources on error paths

Free decoded subject alternative names when certificate conversion
fails, and close the key log file if the BIO allocation fails.

Backport to 3.15 and 3.14.

Author: JelleZijlstra

Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst

@@ -0,0 +1,2 @@
+Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup
+fails.

Modules/_ssl.c

@@ -1549,6 +1549,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) {
 
 
   fail:
+    sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
     if (biobuf != NULL)
         BIO_free(biobuf);
 

Modules/_ssl/debughelpers.c

@@ -232,6 +232,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
 
     self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT);
     if (self->keylog_bio == NULL) {
+        fclose(fp);
         PyErr_SetString(get_state_ctx(self)->PySSLErrorObject,
                         "Can't malloc memory for keylog file");
         return -1;