gh-159739: Release SSL resources on error paths (GH-159745)

Free decoded subject alternative names when certificate conversion
fails, and close the key log file if the BIO allocation fails.

Backport to 3.15 and 3.14.

Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>

Author: jelle-openai

Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst

@@ -0,0 +1,2 @@
+Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup
+fails.

Modules/_ssl.c

@@ -1549,6 +1549,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) {
 
 
   fail:
+    sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
     if (biobuf != NULL)
         BIO_free(biobuf);
 

Modules/_ssl/debughelpers.c

@@ -232,6 +232,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
 
     self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT);
     if (self->keylog_bio == NULL) {
+        fclose(fp);
         PyErr_SetString(get_state_ctx(self)->PySSLErrorObject,
                         "Can't malloc memory for keylog file");
         return -1;