gh-159739: Release SSL resources on error paths (GH-159745)

Free decoded subject alternative names when certificate conversion
fails, and close the key log file if the BIO allocation fails.

Backport to 3.15 and 3.14.
(cherry picked from commit b2b0a33)

Co-authored-by: Jelle Zijlstra <jelle@openai.com>
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>

Author: 2 people

Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst

@@ -0,0 +1,2 @@
+Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup
+fails.

Modules/_ssl.c

@@ -1512,6 +1512,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) {
 
 
   fail:
+    sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
     if (biobuf != NULL)
         BIO_free(biobuf);
 

Modules/_ssl/debughelpers.c

@@ -220,6 +220,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
 
     self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT);
     if (self->keylog_bio == NULL) {
+        fclose(fp);
         PyErr_SetString(get_state_ctx(self)->PySSLErrorObject,
                         "Can't malloc memory for keylog file");
         return -1;